insider threat: preventing direct action attacks … › dtic › tr › fulltext › u2 ›...
Post on 29-Jun-2020
3 Views
Preview:
TRANSCRIPT
INSIDER THREAT: PREVENTING DIRECT ACTION ATTACKS WITHIN THE
UNITED STATED ARMY
A thesis presented to the Faculty of the US Army Command and General Staff College in partial
fulfillment of the requirements for the degree
MASTER OF MILITARY ART AND SCIENCE
Homeland Security Studies
by
PAUL T. DEMING, MAJOR, US ARMY B.A., University of Texas at El Paso, El Paso, Texas, 2006
Fort Leavenworth, Kansas 2017
Approved for public release; distribution is unlimited. Fair use determination or copyright permission has been obtained for the inclusion of pictures, maps, graphics, and any other works incorporated into this manuscript. A work of the United States Government is not subject to copyright, however further publication or sale of copyrighted images is not permissible.
ii
REPORT DOCUMENTATION PAGE Form Approved OMB No. 0704-0188
Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS. 1. REPORT DATE (DD-MM-YYYY) 09-06-2017
2. REPORT TYPE Master’s Thesis
3. DATES COVERED (From - To) AUG 2016 – JUN 2017
4. TITLE AND SUBTITLE Insider Threat: Preventing Direct Action Attacks Within the United States Army
5a. CONTRACT NUMBER 5b. GRANT NUMBER 5c. PROGRAM ELEMENT NUMBER
6. AUTHOR(S) Paul T. Deming, Major
5d. PROJECT NUMBER 5e. TASK NUMBER 5f. WORK UNIT NUMBER 7. PERFORMING ORGANIZATION NAME(S) AND ADDRESS(ES)
U.S. Army Command and General Staff College ATTN: ATZL-SWD-GD Fort Leavenworth, KS 66027-2301
8. PERFORMING ORG REPORT NUMBER
9. SPONSORING / MONITORING AGENCY NAME(S) AND ADDRESS(ES)
10. SPONSOR/MONITOR’S ACRONYM(S) 11. SPONSOR/MONITOR’S REPORT NUMBER(S) 12. DISTRIBUTION / AVAILABILITY STATEMENT
Approved for Public Release; Distribution is Unlimited 13. SUPPLEMENTARY NOTES 14. ABSTRACT Although relatively rare in occurrence, direct action attacks carried out by insider threats against fellow Soldiers have a significant impact on both the psyche of the Soldiers, families, and units involved as well as US Army counterterrorism education and training programs. In almost every instance of violence carried out by an insider threat, the attacker displayed warnings and indicators prior to conducting the attack. One of the biggest challenges to preventing insider attacks is receiving and recognizing reliable tips from those who know the attacker prior to an attack. This thesis studies current Army doctrine and regulations to identify the elements of its education of Soldiers to recognize threats, options available to commanders with insider threats in their formations, and more importantly, how to best compel Soldiers to report suspicious activities and behaviors.
15. SUBJECT TERMS Insider Threat, Extremist Activity, Targeted Violence, Terrorism, Kreutzer, Hasan, TARP, Army Command Policy, UCMJ, Behavioral Indicators 16. SECURITY CLASSIFICATION OF: 17. LIMITATION
OF ABSTRACT
18. NUMBER OF PAGES
19a. NAME OF RESPONSIBLE PERSON a. REPORT b. ABSTRACT c. THIS PAGE 19b. PHONE NUMBER (include area code)
(U) (U) (U) (U) 92 Standard Form 298 (Rev. 8-98)
Prescribed by ANSI Std. Z39.18
iii
MASTER OF MILITARY ART AND SCIENCE
THESIS APPROVAL PAGE
Name of Candidate: Major Paul T. Deming Thesis Title: Insider Threat: Preventing Direct Action Attacks Within the United States
Army
Approved by: , Thesis Committee Chair Heather R. Karambelas, M.A. , Member Richard T. Anderson, M.A. , Member O. Shawn Cupp, Ph.D. Accepted this 9th day of June 2017 by: , Director, Graduate Degree Programs Prisco R. Hernandez, Ph.D. The opinions and conclusions expressed herein are those of the student author and do not necessarily represent the views of the U.S. Army Command and General Staff College or any other governmental agency. (References to this study should include the foregoing statement.)
iv
ABSTRACT
INSIDER THREAT: PREVENTING DIRECT ACTION ATTACKS WITHIN THE UNITED STATES ARMY, by Major Paul T. Deming, 92 pages. Although relatively rare in occurrence, direct action attacks carried out by insider threats against fellow Soldiers have a significant impact on both the psyche of the Soldiers, families, and units involved as well as US Army counterterrorism education and training programs. In almost every instance of violence carried out by an insider threat, the attacker displayed warnings and indicators prior to conducting the attack. One of the biggest challenges to preventing insider attacks is receiving and recognizing reliable tips from those who know the attacker prior to an attack. This thesis studies current Army doctrine and regulations to identify the elements of its education of Soldiers to recognize threats, options available to commanders with insider threats in their formations, and more importantly, how to best compel Soldiers to report suspicious activities and behaviors.
v
ACKNOWLEDGMENTS
First, I would like to thank my wife for her support during the duration of the
writing of this thesis. I could always rely on her to provide the motivation needed to
continue the countless hours of research.
Second, I thank my parents for instilling in me the value of hard work. This will
continue to serve me throughout my career.
Finally, I would like to thank my thesis committee. Their guidance and direction
helped me turn an idea into reality. Thank you to Ms. Heather Karambelas, Dr. O. Shawn
Cupp, and Mr. Richard Anderson. You truly represent the commitment of the faculty at
the Command and General Staff College to its students.
vi
TABLE OF CONTENTS
Page
MASTER OF MILITARY ART AND SCIENCE THESIS APPROVAL PAGE ............ iii
ABSTRACT ....................................................................................................................... iv
ACKNOWLEDGMENTS ...................................................................................................v
TABLE OF CONTENTS ................................................................................................... vi
ACRONYMS ................................................................................................................... viii
FIGURES .............................................................................................................................x
TABLES ............................................................................................................................ xi
CHAPTER 1 INTRODUCTION .........................................................................................1
Purpose ............................................................................................................................ 1 Proposed Research Question .......................................................................................... 2 Importance ...................................................................................................................... 2 Assumptions .................................................................................................................... 3 Operational Definition of Key Terms ............................................................................. 4
Insider Threat Defined ................................................................................................ 4 Extremist Activity Defined ......................................................................................... 5 Threat Defined ............................................................................................................ 5 Terrorism Defined ....................................................................................................... 5 Targeted Violence Defined ......................................................................................... 6
Scope ............................................................................................................................... 6 Limitations ...................................................................................................................... 7 Delimitations ................................................................................................................... 7 Significance of Study ...................................................................................................... 8 Chapter Summary ........................................................................................................... 9
CHAPTER 2 LITERATURE REVIEW ............................................................................10
Chapter Introduction ..................................................................................................... 10 Case Studies .................................................................................................................. 11 Fort Bragg, 1995 ........................................................................................................... 12 Fort Hood, 2009 ............................................................................................................ 16 Education ...................................................................................................................... 25 Options Available to Commanders ............................................................................... 30
Limitations on Information Sharing .......................................................................... 30 Organizational Relationships .................................................................................... 32
vii
Command Policy ....................................................................................................... 33 Chapter Summary ......................................................................................................... 45
CHAPTER 3 RESEARCH METHODOLOGY ................................................................47
Chapter Introduction ..................................................................................................... 47 Why These Case Studies? ............................................................................................. 48 Education ...................................................................................................................... 49 Options Available to Commanders ............................................................................... 50 Analytical Model .......................................................................................................... 50 Threats to Validity ........................................................................................................ 56 Chapter Summary ......................................................................................................... 57
CHAPTER 4 DATA PRESENTATION AND ANALYSIS .............................................59
Chapter Introduction ..................................................................................................... 59 Qualitative Analysis ...................................................................................................... 59
Variable 1: TARP indicators of potential international terrorist-associated insider threats ........................................................................................................................ 60 Variable 2: TARP indicators of extremist activity that may pose a threat to the Department of Defense or disrupt US military operations ....................................... 62 Variable 3: participation in extremist organizations and activities as defined by Army Command Policy ............................................................................................ 64 Variable 4: Possible UCMJ violations for participation in extremist organizations or activities .................................................................................................................... 66 Variable 5: Administrative actions available to commanders .................................. 67 Variable 6: Punitive actions available to commanders ............................................. 68 Variable 7: Other actions available to commanders ................................................. 69
Chapter Summary ......................................................................................................... 70
CHAPTER 5 CONCLUSIONS AND RECOMMENDATIONS ......................................72
Chapter Introduction ..................................................................................................... 72 Conclusions ................................................................................................................... 73 Recommendations ......................................................................................................... 76 Areas for Further Study ................................................................................................ 77 Summary ....................................................................................................................... 78
GLOSSARY ......................................................................................................................79
BIBLIOGRAPHY ..............................................................................................................80
viii
ACRONYMS
AR Army Regulation
CI Counterintelligence
CID Criminal Investigation Division
DA Department of the Army
DOD Department of Defense
DODI Department of Defense Instruction
DOTMLPF-P Doctrine, Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy
EO Equal Opportunity
FBI Federal Bureau of Investigation
GEN General (Army rank, O-10)
HIPAA Health Insurance Portability and Accountability Act of 1996
INSCOM Intelligence and Security Command
ITO International Terrorist Organization
JPAS Joint Personnel Adjudication System
MAJ Major
MCM Military Manual for Courts-Martial
NCIS Naval Criminal Investigative Service
NCO Noncommissioned Officer
OER Officer Evaluation Report
OSI Office of Special Investigations
PCS Permanent Change of Station
PMO Provost Marshall’s Office
ix
POSH Prevention of Sexual Harassment
R2C Ready and Resilient Campaign
SAEDA Subversion and Espionage Directed Against the US Army
SBT Stand Alone Briefing Tool
SGT Sergeant
SHARP Sexual Harassment/Assault Response Program
TARP Threat Awareness and Reporting Program
UCMJ Uniformed Code of Military Justice
US United States
USA United States Army
USC United States Code
USUHS Uniformed Services University of the Health Sciences
x
FIGURES
Page Figure 1. Indicators of potential international terrorist-associated insider threats ..........28
Figure 2. Indicators of extremist activity that may pose a threat to Department of Defense or disrupt US military operations.......................................................28
Figure 3. Maximum Punishments in Article 15 ..............................................................41
xi
TABLES
Page Table 1. Sub-variables of TARP Indicators of Potential International Terrorist-
Associated Insider Threats ...............................................................................52
Table 2. Sub-variables of TARP Indicators of Extremist Activity ................................53
Table 3. Sub-variables of Participation in Extremist Organizations and .......................54
Table 4. Sub-variables of UCMJ Violations ..................................................................54
Table 5. Sub-variables of Administrative Actions Available to Commanders ..............55
Table 6. Sub-variables of Punitive Actions Available to Commanders ........................55
Table 7. Sub-variables of Other Actions Available to Commanders .............................55
Table 8. TARP Indicators of Potential International Terrorist-Associated Insider Threats..............................................................................................................62
Table 9. TARP Indicators of Extremist Activity That May Pose a Threat to the Department of Defense or Disrupt US Military Operations ............................64
Table 10. Participation in Extremist Organizations and Activities as Defined by Army Command Policy ...................................................................................65
Table 11. Possible UCMJ Violations for Participation in Extremist Organizations or Activities ......................................................................................................66
Table 12. Administrative Actions Available to Commanders .........................................67
Table 13. Punitive Actions Available to Commanders ....................................................68
Table 14. Other Actions Available to Commanders ........................................................70
Table 15. Overall Case Study Comparison Results .........................................................71
1
CHAPTER 1
INTRODUCTION
Hasan’s ideology conflicted with standard military obligations, and his repeated statements that he could not support combat against enemies of this country because they shared his religious beliefs demonstrated that he did not belong in the United States military.
― GEN Jack Keane, USA, Retired A Ticking Time Bomb
In October 1995, US Army Sergeant (SGT) William Kreutzer, a member of the
82nd Airborne Division stationed at Fort Bragg, North Carolina, opened fire on a
morning physical training formation of 1300 Soldiers with two semi-automatic rifles.
Unarmed members of that formation were able to subdue the shooter, but not before he
left one dead and an additional seventeen other Soldiers wounded. In November 2009,
US Army Major Nidal Malik Hasan, a psychiatrist assigned to Fort Hood, Texas, entered
the Fort Hood Soldier Readiness Center and opened fire with a FN Herstal Five-Seven
pistol, killing thirteen and wounding an additional thirty-two before law enforcement
could stop him. In both of these cases, the perpetrators displayed several threat indicators
that if acted upon could have allowed authorities to prevent these attacks. After action
reports and investigations following each of these events all show that people who knew
the attackers were well aware of extremist or violent tendencies, but either dismissed the
indicators or failed to report.
Purpose
Although relatively rare, insider threat events still occur in US Army formations.
Based upon these actions many actions could and should take place. These threats take
2
away from readiness and require commanders and units to ensure all mitigation measures
take place to prevent or reduce the effects of these insider threat direct action attacks.
This thesis will use the findings from case studies of past direct action attacks to propose
training recommendations that would compel soldiers who witness indicators to report.
Proposed Research Question
In order to help law enforcement, commanders, and the intelligence community to
prevent insider threats from developing into direct action attacks, this study sought to
answer the question: How does the Army compel Soldiers to report suspicious activity
associated with insider threats? In addition, secondary research questions include: What
are the Threat Awareness and Reporting Program's (TARP) goals, and what should it
provide? Does the Army’s mandatory TARP training effectively prevent direct action
attacks by insider threats? What actions are available to commanders who identify
potential insider threats within their organizations?
Importance
Although the numbers of casualties inflicted by insider threats are relatively small
when compared to combat casualties or other threats to service members, such as
vehicular accidents, direct action attacks against unarmed Soldiers carried out by their
comrades have a significant impact on the sense of security of personnel on a military
installation. Preventing an insider threat attack is a daunting task to law enforcement,
commanders, and the intelligence community, as it is extremely difficult in most
circumstances to identify would-be attackers without the help of fellow Soldiers reporting
suspicious activity. Even then, would-be attackers often do not break any laws prior to
3
actually conducting the attack, so what is the proper response when the military chain of
command and law enforcement actually do receive indications of a threat within their
formations?
Assumptions
First, insider threat direct action attacks are typically a result of a lone perpetrator
who for one reason or another feels ostracized by the chain of command and/or their
peers for their personal beliefs. Historically, there are several events over time that drive
the attacker to gradually come to the point where they are willing to carry out an attack.
Next, this study assumed that Soldiers and commanders are reluctant to act on suspicions
when they notice violent tendencies because they are either afraid of offending certain
beliefs or because they do not take the threats seriously. The Army trains extensively on
religious freedoms, Equal Opportunity (EO), and rights of Soldiers to express their
beliefs, but does not adequately train Soldiers to recognize when these freedoms of
speech overstep their bounds and are actually threats to the good order and discipline, or
even physical safety, of a unit.
The last assumption builds on the previous assumption that soldiers are not
properly trained to recognize and report insider threats. This assumption is that more
training can successfully to reduce attacks. This training should focus on two areas. First,
soldiers and commanders need training to recognize when potential insider threats are
marginalized within their organizations, and how they can bring these soldiers back into
the fold. If soldiers are accepted for who they are and brought into the cohesiveness of a
team, they will be less likely to feel the need to commit an act of violence against their
4
peers. Second, training can help compel soldiers to report suspicious behavior to their
command or proper authorities.
Operational Definition of Key Terms
Insider Threat Defined
The insider threats referenced in this study are narrowly focused on persons who
are US service members or DOD employees who plan or carry out direct action attacks
on fellow Soldiers and DOD employees with the intent to inflict loss of life through
violent means. This definition does not match up exactly with the official Army
definition of insider threat, which is broader in its description.
The official Army definition of an insider threat comes from Army Regulation
381-12, Threat Awareness and Reporting Program. According to TARP, an insider threat
is a person with placement and access who intentionally causes loss or degradation of
resources or capabilities or compromises the ability of an organization to accomplish its
mission through espionage, providing support to international terrorism, or the
unauthorized release or disclosure of information about the plans and intentions of US
military forces. There are two main issues with the Army’s official definition. First, it
primarily focuses on espionage and the unauthorized release of information. Second, the
part that addresses terrorist type direct action attacks specifically ties the act to
international terrorism. While this may be true in some cases, not all direct action attacks
have clearly defined ties to international terrorist organizations (ITOs). These types of
activities fall into the next two key terms.
5
Extremist Activity Defined
According to AR 381-12, extremist activity is defined as an activity that involves
the use of unlawful violence or the threat of unlawful violence directed against the Army,
DOD, or the United States based on political, ideological, or religious tenets, principles,
or beliefs. While this definition fits with the Nidal Hasan case study, it still does not
address the William Kreutzer shooting that took place in 1995.
Threat Defined
TARP’s definition of a threat is a little broader than its definitions of insider threat
and extremist activity. According to AR 381-12, a threat is described as the activities of
foreign intelligence services, foreign adversaries, ITOs, or extremists that may pose a
danger to the Army, DOD, or the United States; any person with access to Soldiers, DOD
installations, and facilities who may be positioned to compromise the ability of a unit to
accomplish its mission where there is evidence to indicate that he may be acting on
behalf of or in support of foreign intelligence, foreign adversaries, international terrorists,
or extremist causes (insider threat).
Terrorism Defined
According to AR 381-12, terrorism is defined as the calculated use of violence or
threat of violence to inculcate fear, intended to coerce or to intimidate governments or
societies in the pursuit of goals that are generally political, religious, or ideological.
Terrorism according to this definition differs from workplace violence. In the case of the
Fort Hood shootings of 2009, the ties to Islamic extremism and a known international
terrorist classify that attack as a terrorist attack. In the Fort Bragg shootings of 1995,
6
there were no known political, religious, or ideological ties, which would not classify that
attack as an act of terrorism. However, since the perpetrator was a soldier who attacked
other soldiers, both cases do classify as insider threats.
Targeted Violence Defined
For the purpose of this study, this thesis will use the definition used in the 2014
DOD Defense Science Board Task Force Report: Predicting Violent Behavior. According
to the report, targeted violence is pre-meditated attacks against specific individuals,
populations, or facilities with perpetrators engaged in behaviors that precede and are
related to their attacks. Perpetrators of targeted violence consider, plan, and prepare
before engaging in acts of violence. Planning and preparation steps are often detectable,
providing an opportunity for disruption of intended violence. These perpetrators feel that
they are not valued/validated and are singled out. They subsequently feel that
organizations or specific people are out to get them. There is a shift from self-defense to
self-preservation and thus a need to destroy the individuals, populations, or the
organizational representatives that they feel wants to destroy them. Violence is then
viewed as an option and the progression from ideation to attack begins. Targeted violence
motivators are not limited to a single cause (e.g. a particular religious, financial, racial, or
social outlook).
Scope
The information obtained in the conduct of research for this thesis derived from
current Army doctrine, congressional reports, court cases, and case studies. In order to
assess the scope of the problem and identify answers to the research questions, this study
7
conducted a literature review of the available research. This thesis seeks to achieve three
goals: (1) Identify current Army policies and regulations regarding TARP education of
the force, (2) Identify all available options to commanders and supervisors who have
high-risk Soldiers within their formations, and (3) Make recommendations toward
improving how the Army compels Soldiers to report suspicious behaviors and activities
to the proper authorities.
Limitations
The primary limitation is the time available to conduct research. There are
multiple sources of research material available on the subject, much of which will be
discussed in the next chapter of this study. These sources of information range from
current and past Army doctrine, after action reports, congressional hearings, military
journal articles, and case studies. Given more time, it would be possible to delve deeper
into the topic and potentially develop additional research findings.
In addition, use of secondary source material due to lack of access to law
enforcement original reports limits the amount of first-hand knowledge available for
research. Specifically for the case studies, the majority of information is derived from US
Senate hearings or other case studies written by second-hand sources. Actual interviews
of witnesses or others involved in the cases were not available to the researcher.
Delimitations
Although there are many cases where insider threats conducted targeted violence
within the United States, this study focused solely on cases where a US Army Soldier
attacked fellow Soldiers. For the purposes of this study, plots against US service
8
members carried out by civilians or civilian on civilian attacks were not considered. The
reason for this is to focus specifically on what steps the Army needs to take in order to
counter insider threats within its own organization. However, narrowing the scope of the
case studies does not go without implications.
The use of only two case studies may provide a challenge to the findings of the
research. First, there is only a limited amount of information available to the specific
cases of insider threat the author chose to research. Second, as stated before, the
information available concerning these two case studies is limited to second or third-hand
knowledge of the incidents. Without reading first-hand reports, some of the details of the
cases could potentially be missed by the author. Currently, TARP training is only
conducted annually. With proper reinforcement and multiple training events per year,
Soldiers could be less likely to keep reporting as an afterthought.
Significance of Study
Direct action attacks carried out by insider threats have a psychological impact on
units across the force. Although they are relatively rare, the ramifications to Army
doctrine and training are significant. This study intends to highlight some of the
vulnerabilities in current Army insider threat doctrine and identify the reasons service
members are hesitant to report suspicious activity to their commanders, law enforcement,
and intelligence services. Upon examination of the research findings, this study will
propose some solutions to increase reporting, thereby reducing the number of attacks.
9
Chapter Summary
This thesis examines the primary research question: How does the Army compel
Soldiers to report suspicious activity associated with insider threats? Secondary research
questions are as follows:
1. What are the Threat Awareness and Reporting Program's (TARP) goals, and
what should it provide?
2. Does the Army’s mandatory TARP training effectively prevent direct action
attacks by insider threats?
3. What actions are available to commanders who identify potential insider
threats within their organizations?
As an initial research hypothesis the author proposes that: current TARP training is not
sufficient to properly educate Soldiers to report indicators of insider threats and
commanders do not understand the options that are available to them when they have
high-risk Soldiers within their formations.
Chapter 2 will review the literature on this topic and provide an assessment of its
significance to this thesis. It will be followed by an explanation of the methodology, and
the subsequent chapters will examine Army doctrine and two case studies, in detail. The
conclusion of this project will provide recommendations on improved implementation of
TARP.
10
CHAPTER 2
LITERATURE REVIEW
Chapter Introduction
This chapter focuses on the available literature on insider threats, as well as the
Army’s doctrine on countering insider threat. The primary research question this study
intends to answer is: How does the Army compel Soldiers to report suspicious activity?
In addition, secondary research questions include: Does the Army’s mandatory Threat
Awareness and Reporting Program (TARP) training effectively prevent direct action by
insider threats? What are TARP's goals, and what should it provide?
This literature is structured in accordance with the three primary sections of the
study. First, this thesis examines two case studies where US Army Soldiers conducted
targeted violence against their fellow Soldiers. This section looks at the attackers’
motivations, indicators they presented prior to the attacks, and reasons these attacks were
not prevented. Second, the literature review looks into the Army’s insider threat
education and reporting program, or TARP, as well as any other formalized education for
cultural understanding. Third, the study delved into Army policies and regulations
regarding options currently available to commanders with identified high risk Soldiers in
their formations. This includes limitations on information sharing and general
understanding of the Privacy Act of 1974, the Health Insurance Portability and
Accountability Act of 1996 (HIPAA), and organizational constructs that limit
information sharing among different commands and agencies. It also includes research
into command policy to identify all available options to commanders such as disciplinary
actions, administrative options, and external support from outside organizations.
11
In order to focus the study specifically on insider threats pertaining to targeted
violence, this literature review does not include information pertaining to cases involving
espionage or the release of information about plans and intentions of US military forces.
Although TARP covers a broad range of insider threats, this thesis deals with the sections
that involve terrorist actions and targeted violence. The literature reviewed is not limited
in scope to insider threats with ties to a foreign nexus, nor is it limited to insider threats
that could be classified as terrorists. This study looked at all insider threats to US Army
personnel, regardless of the attacker’s motivations for conducting the attacks.
Case Studies
For the two insider threat cases considered in this study, the majority of available
literature consists of US Government investigative after action reports and court hearing
transcripts. These reports provided background information on the perpetrators and
attacks, indicators the perpetrators displayed prior to the attacks, and shortfalls in
intelligence and law enforcement agencies in identifying the threats prior to the attacks.
These reports identify that in both cases key indicators were either seen and not reported,
reported and not developed by law enforcement, or known to commanders or law
enforcement yet not acted upon.
In regards to missing information in the case studies the author sought to identify,
there are two main areas of focus. First, the researcher did not have access to original law
enforcement and intelligence reports. Therefore, all information obtained during the
conduct of research was through second or third-party information. Access to first-hand
information could possibly provide further context into the attacks and provide
information regarding the command relationships and other factors involving the
12
attackers. Second, although the available information pertaining to the two case studies
provided significant information concerning the attacks and the events leading up to the
attack, neither case study addresses the author’s primary question, how to best compel
Soldiers to report. This research adds to the body of knowledge by adding
recommendations toward prevention of future attacks to the current analysis of past
attacks.
Fort Bragg, 1995
At 0631 on 27 October 1995, Army Sergeant (SGT) William Kreutzer, Jr. opened
fire on a 2nd Brigade, 82nd Airborne Division formation preparing for a brigade run from
a nearby wood line. Armed with two semi-automatic rifles, two pistols, a knife, and
nearly 900 rounds of ammunition, he methodically wounded eighteen Soldiers and killed
one. The death toll could have been much worse if not for the heroic actions of several
unarmed Soldiers, who upon hearing the shots, rushed the attacker and subdued him until
law enforcement arrived on the scene.1
SGT Kreutzer’s attack on fellow members of his unit was not a spontaneous act.
The Army’s failure to recognize Kreutzer as a potential insider threat could be identified
as early as three years prior to the attack during his service with the Long Range
Surveillance Company in the XVIII Airborne Corps from August 1992 to March 1993.
During this time, he told one Soldier, “One of these days I am going to kill somebody.”2
1 United States v. Sergeant William J. Kreutzer, Jr., Army 9601044 United States
Army Court of Criminal Appeals (11 March 2004), 23-24.
2 Ibid., 20.
13
Kreutzer also expressed a desire to form a sniper team to kill the President. In addition to
these violent remarks, Kreutzer’s performance as a Soldier was mediocre at best, which
led to a reassignment to A Company, 4th Battalion, 325th Airborne Infantry Regiment,
82nd Airborne Division.3
During a six month deployment to the Sinai Peninsula in Egypt, Kreutzer’s
mental health deteriorated considerably. His relative inexperience as a Soldier and his
perceived strange personality led to problems between him and members of his unit.
Kreutzer became the butt of several practical jokes and teasing, which angered him to the
point of fantasizing out loud about killing some of his squad members. In June 1994,
Kreutzer told another Soldier in his platoon that he intended to get an automatic weapon
and “hose down the enlisted barracks.”4 As a result of these outbursts, his fellow Soldiers
thought he was crazy and referred to him as “Crazy Kreutzer,” “Hannibal Lector,” and
“Psycho.”5 Following another incident, Kreutzer’s platoon sergeant talked to him about
his statements and behavior, in which Kreutzer stated he “Was so frustrated with the
situation he had been thinking about shooting the members of his team.”6
Following the discussion with his platoon sergeant, Kreutzer’s chain of command
removed him from his position, denied him access to weapons, and command referred
him to seek mental health. After two meetings with the division mental health officer, it
3 United States v. Kreutzer, 20.
4 Ibid., 21.
5 Ibid.
6 Ibid.
14
was determined that Kreutzer had “problems with anger and interpersonal relationships,
poor coping skills, and low self-esteem, but that he was not a danger to others.”7
Following the deployment to the Sinai, Kreutzer met with the behavioral health officer
once more and declined further counseling, which closed the case. Although the mental
health case was closed, perceptions of his fellow Soldiers remained skeptical. One
lieutenant even joked that “Perhaps one day in the future we would see him in a
McDonalds blowing people away.”8
Despite the ample documented cases of violent tendencies, Kreutzer’s chain of
command elevated him to acting squad leader following successful attendance to the
Primary Leadership Development Course in October 1994. By March 1995, Kreutzer was
promoted to SGT and assigned as the weapons squad leader. Even in his new leadership
position, fellow Soldiers did not respect him. Other noncommissioned officers (NCOs)
told members of his squad not to listen to or obey Kreutzer’s orders. Kreutzer’s threats
and obsession with weapons, war, and death earned him the new nicknames of “crazy,”
“Wild Bill,” and “wacko.”9 This humiliation led to Kreutzer further distancing himself
from other Soldiers in his unit.
By October 1995, Kreutzer began to feel increasingly stressed. His worries over
his sister’s injuries from a water skiing accident, new additional duties assigned to him,
and a letter of reprimand over temporarily losing an M-60 machine gun barrel only added
7 United States v. Kreutzer, 21.
8 Ibid.
9 Ibid., 22.
15
to Kreutzer’s threats to kill his superiors and fellow Soldiers. This stress culminated on
26 October 1995 when SGT Kreutzer failed a key control inspection and his squad failed
a packing list inspection. He decided to purchase his Soldiers’ missing gear with his own
money, and when doing so he concluded the Army as a whole did not care about
Soldiers. It was at this point Kreutzer decided to “shoot up the run the next morning” to
make others “take notice… that they weren’t taking care of Soldiers.”10
That evening, Kreutzer gathered the weapons and ammunition for the next
morning’s attack and spent the night at a motel instead of the barracks. At 2010, he called
a member of his squad and told him not to go to the brigade run the next morning. When
asked to explain why, Kreutzer told him he was going to “mow everyone down.”11 The
Soldier thought Kreutzer was joking and did not take him seriously because he had
previously talked about killing people. It was not until the following morning when
Kreutzer did not show up for formation that the Soldier realized something was wrong.
The United Stated Army Court of Criminal Appeals, US v. Sergeant William J.
Kreutzer, Jr. thoroughly lays out the background events leading up to the 1995 Fort
Bragg shooting incident. It goes into relative depth of Kreutzer’s family background and
the indicators of his violent tendencies in the years prior to the attack. However, this is
not the main focus of the hearing. The majority of the appeal is based on identifying the
shortcomings of the defense during the trial after the attack, and to determine if the death
10 United States v. Kreutzer, 23.
11 Ibid.
16
sentence Kreutzer originally received was the appropriate sentence for the crimes he
committed.
The appeal hearing breaks down the following topics into the facts involved, the
law, and a follow-up discussion: denial of defense requested expert consultant in capital
mitigation, ineffective assistance of counsel, and a final decision of the court. While this
reference discusses the actions Kreutzer’s chain of command took following each violent
indicator he presented, it does not explain the command’s reasoning for those actions.
This reference also does not explain the options that were available to the command as a
response to Kreutzer’s threats.
Fort Hood, 2009
One of the most well-known and publicized insider threat attacks in recent US
history occurred on November 5, 2009 at Fort Hood, Texas. Army MAJ Nidal Malik
Hasan walked into the Fort Hood deployment center armed with two handguns and began
to open fire. Within a matter of minutes, thirteen DOD employees were dead and another
32 were wounded in the worst terrorist attack on US soil since September 11, 2001.
In response to this incident, the US Senate Committee on Homeland Security and
Governmental Affairs launched an investigation of the events leading up to the attack
with two goals. First, they assessed the information available to the US Government prior
to the attack and the actions it took or failed to take in response to that information.
Second, they sought to identify steps necessary to protect the US against future acts of
terrorism by homegrown violent Islamic extremists. The information and analysis gained
through this investigation was published in a final report on February 3, 2011 titled “A
17
Ticking Time Bomb: Counterterrorism Lessons Learned from the US Government’s
Failure to Prevent the Fort Hood Attack.”
In order to fully understand the indicators of violent tendencies Nidal Hasan
displayed, one must understand the self-radicalization process he went through and the
beliefs of Islamic extremists. The core principles of violent Islamist extremism are the
establishment of a global state – or caliphate – where the most radical interpretation of
Shari’ah (Islamic religious law) is enforced by the government. The global Islamist
community is prioritized ahead of one’s community and country. In order to accomplish
this, the use of violence against the West generally, military personnel, and civilians is
justified. Additionally, Muslims who reject these extremist principles are also considered
by violent Islamic extremists to be the enemy.12
The process by which an individual transitions to a violent Islamist extremist is
known as radicalization.13 The radicalization process generally consists of four phases.14
Pre-radicalization is the state of an individual just prior to the start of their journey down
the path of radicalization.15 An individual’s lifestyle, religion, education, social status,
12 Joseph I. Lieberman and Susan M. Collins, A Ticking Time Bomb:
Counterterrorism Lessons from the U.S. Government’s Failure to Prevent the Fort Hood Attack (Washington, DC: United States Senate Committee on Homeland Security and Governmental Affairs, 2011), 17, accessed 21 November 2016, https://www.hsgac.senate.gov/imo/media/doc/Fort_Hood/FortHoodReport.pdf.
13 Ibid.
14 Mitchell D. Silber and Arvin Bhatt, “Radicalization in the West: The Homegrown Threat,” Police Department, City of New York, accessed 29 December 2016, www.sethgodin.typepad.com/seths_blog/files/NYPD_Report-Radicalization_in_ the_west.pdf, 19.
15 Ibid., 22.
18
neighborhood, and environment in general all influence their eventual openness to this
ideology. Self-identification marks the point where an individual experiences a crisis or
significant event that leads them to question their previously held beliefs.16 In turn, the
individual seeks answers to their grievances through a radical interpretation of Islam.
During Indoctrination, individuals adopt violent Islamist extremist ideology and
begin to see the world as a struggle against the West.17 This is the stage where an
individual progressively intensifies his beliefs in a radical interpretation of Islam, and that
the conditions and circumstances exist to support and further the cause.18 Finally, the
Violence stage is where individuals accept their duty to participate in jihad.19
Nidal Hasan graduated from Virginia Tech with an engineering degree in 1992
and entered military service in 1995. In 1997, he entered medical school at the Uniformed
Services University of the Health Sciences (USUHS) and graduated in 2003. Hasan was a
resident in the psychiatric program at Walter Reed Army Medical Center from 2003 to
2007, and it was here that his first signs towards violent Islamist extremism began to
manifest.20 Hasan openly questioned to classmates whether he could engage in combat
against other Muslims. During the third year of his residency, Hasan’s conflicts with
16 Silber and Bhatt, 30.
17 Lieberman and Collins, A Ticking Time Bomb, 18.
18 Silber and Bhatt, 36.
19 Ibid., 43.
20 Lieberman and Collins, A Ticking Time Bomb, 28.
19
service obligations ripened to the point that one of his supervisors tried twice to convince
him to leave the military.21
From 2006 to 2008 Hasan’s radicalization to violent Islamist extremism came into
plain view. This was the last year of his Walter Reed residency and the first year of his
USUHS fellowship. One of the academic requirements for graduation from his residency
was to make a presentation on psychiatric issues. Hasan chose to fulfill this requirement
by giving an off-topic lecture on violent Islamist extremism. His draft presentation
consisted almost entirely of references to the Koran, without a single mention of a
medical or psychiatric term.22 Hasan’s draft presentation also presented extremist
interpretations of the Koran as supporting grave physical harm and killing of non-
Muslims.23 He even suggested that revenge might be a defense for the terrorist attacks of
September 11, 2001.24 Hasan’s superiors warned him that he needed to revise the
presentation if he wanted to graduate25 but did not take any further action.
Upon reviewing the draft presentation, the Psychiatric Residency Program
Director questioned whether Hasan was fit to graduate.26 He thought Hasan was “very
21 Lieberman and Collins, A Ticking Time Bomb, 28.
22 Ibid.
23 Ibid.
24 Ibid.
25 Ibid.
26 Ibid.
20
lazy” and “a religious fanatic.”27 However, Hasan improved the presentation and received
credit even through a review of the final version showed that it was still essentially a
collection of Koranic verses with minimal scholarly content.28 Hasan graduated despite
the Program Director’s reservations.29 Probably the most chilling feature of both drafts of
Hasan’s presentation was that he stated one of the risks of having Muslim-Americans in
the military was the possibility of fratricidal murder of fellow service members.30
Following his residency, Hasan advanced to a two year fellowship at USUHS.
Under normal circumstances, Hasan never would have been accepted to the fellowship,
as it was typically reserved for elite medical professionals.31 Officers involved in the
fellowship selection process recounted that Hasan was accepted into the program because
he was the only Army applicant and the Army did not want to risk losing that fellowship
if it was not filled.32 Hasan told a colleague that he applied only to avoid a combat
deployment to a Muslim country. Realizing Hasan’s motivations, one of his supervisors
warned against accepting him.33
27 Lieberman and Collins, A Ticking Time Bomb, 28.
28 Ibid., 29.
29 Ibid.
30 Ibid.
31 Ibid.
32 Ibid.
33 Ibid.
21
Almost immediately upon starting the fellowship, Hasan’s radical beliefs became
unmistakable and it was clear he embraced violent Islamist extremism. Classmates felt he
had “fixed radical beliefs about fundamentalist Islam” and that he shared them “at every
possible opportunity.”34 Less than a month into his fellowship in August 2007, Hasan
gave another controversial off-topic presentation even more incendiary than his previous
brief at Walter Reed.
Hasan’s latest presentation entitled, Is the War on Terror a War on Islam: An
Islamic Perspective, suggested that US military operations are a war against Islam rather
than based on non-religious security considerations.35 This brief was so controversial the
instructor had to stop it after just two minutes when the class erupted in protest to
Hasan’s views.36 The presentation also gave defense to Osama bin Laden, blamed the
United States for problems in the Middle East, gave support to suicide bombing, and
argued that anger at the United States is justifiable.
Following the presentation, Hasan continued overt support of violent Islamist
extremism to his colleagues. He told several classmates that his religion took precedence
over the US Constitution he swore to support and defend as a US military officer.37
Hasan repeatedly made statements that US policy could lead to fratricide in the ranks.38
34 Lieberman and Collins, A Ticking Time Bomb, 29.
35 Ibid.
36 Ibid.
37 Ibid., 30.
38 Ibid.
22
These statements disturbed his classmates to the point they reported Hasan to superiors.
However, it is important to note that Hasan’s superiors took no action and never reported
him to Army counterintelligence personnel.
Later in the fellowship, Hasan created yet another academic project based on
violent Islamist extremism. Unlike the previous assignments, Hasan framed this one in
clinical terms and was perceived as less controversial than his previous presentations.39
However, this was the third project in less than a year that Hasan dedicated to violent
Islamist extremist views. Despite Hasan’s overt displays of radicalization to violent
Islamist extremism, Hasan’s superiors failed to discipline him, refer him to
counterintelligence officials, or seek to discharge him.40 Although the definitive reasons
for these leadership failures are unknown, one of the officers that reported to Hasan’s
superiors stated that Hasan was permitted to remain in service because of “political
correctness” and ignorance of religious practices.41 That officer added that he believed
that concern about potential discrimination complaints stopped some individuals from
challenging Hasan.42
However, none of Hasan’s superiors cited “political correctness” as the reason for
not acting against Hasan.43 Instead, they gave the following reasons for not acting: (1) A
39 Lieberman and Collins, A Ticking Time Bomb, 30.
40 Ibid., 31.
41 Ibid.
42 Ibid.
43 Ibid.
23
belief that Hasan’s ideological views were not problematic or were at least
understandable, (2) Academic freedom and lack of academic standards, (3) A desire to
preserve the USUHS fellowship by filling it with an Army applicant, (4) A belief that
Hasan provided understanding of violent Islamist extremism as well as the culture and
beliefs of Islam, and (5) A belief that Hasan could perform adequately in an installation
with other psychiatrists to assist him.
Another area Hasan’s superiors failed was proper evaluation of his performance
on paper. Hasan was a chronic poor performer during his residency and fellowship.44 His
directors at both installations viewed him as a bottom 25 percent performer, and he often
failed to meet basic job expectations. However, this poor performance was not accurately
reflected in Hasan’s Officer Evaluation Reports (OERs). His OERs from July 2007 to
June 2009 both gave Hasan passing marks in the seven Army Values and twisted Hasan’s
violent Islamist extremist views in a positive light. One report stated, “His unique
interests have captured the interest and attention of peers and mentors alike.”45 The only
negative mark in either OER was the result of Hasan failing to take a physical training
test.46
Nidal Hasan graduated from the USUHS fellowship in the summer of 2009 and
was subsequently assigned to Fort Hood, Texas. In October he was selected for a
deployment to Afghanistan. Despite Hasan’s history of violent Islamist extremist views,
44 Lieberman and Collins, A Ticking Time Bomb, 33.
45 Ibid.
46 Ibid.
24
he would deploy to provide psychiatric care under stressful conditions in a combat zone
in which the US military is battling violent Islamic extremists.47 On November 5, 2009,
twelve service members and one civilian employee of DOD lost their lives because
Hasan was still in the military.48
The findings of this report concluded the Fort Hood attack could have been
prevented, and placed the blame on two agencies, the DOD and the Federal Bureau of
Investigation (FBI). For the purposes of this study, the preponderance of focus went to
shortfalls in the DOD’s ability to prevent this attack. However, one of the findings did
reveal communication issues between DOD intelligence and law enforcement and the
FBI. Both organizations had knowledge that MAJ Hasan was a potential threat, but each
entity had information that painted a part of the full picture. Had that communication
taken place, proper authorities could have taken the actions necessary to prevent the
attack.
Chapter 3 of “A Ticking Time Bomb” provided the most useful information into
the events and indicators in the years leading up to the November 5th attack. The
investigation obtained the majority of its information for this chapter from Army
Criminal Investigation Division (CID) reports and testimony from first-hand witnesses.
In addition, the investigation gained access to Hasan’s OERs and two Power Point class
presentations Hasan prepared while attending a fellowship at Walter Reed Medical
Center.
47 Lieberman and Collins, A Ticking Time Bomb, 34.
48 Ibid.
25
In these reports and interviews, the investigation found multiple instances where
Nidal Hasan overtly displayed his radicalization to violent Islamist extremism, and
identified that his superiors failed to discipline him for his actions, failed to report him to
Army counterintelligence (CI), and failed to seek discharge from the Army. While this
information is all pertinent to the scope of this study, it fails to answer how the Army can
best compel Soldiers to report. Although the investigation does not specifically mention
TARP, it does lend some insight into the effectiveness, or in this case ineffectiveness, of
the program. Lastly, this case study does not address TARP’s goals and what it should
provide.
Education
The Army’s primary method of education the force about insider threats is Army
Regulation 381-12, Threat Awareness Reporting Program (TARP), dated 1 June 2016. It
provides policy and responsibilities for threat awareness and education and establishes a
requirement for Department of the Army personnel to report any incident of known or
suspected espionage, international terrorism, sabotage, subversion, theft or diversion of
military technology, information systems intrusions, and unauthorized disclosure of
classified information, among others.49 While TARP covers all matters of CI interest
including those listed above, the scope of this paper focuses on TARP’s training
requirements, reporting requirements, and behavioral indicators of terrorist or extremist
activities.
49 US Department of the Army, Army Regulation (AR) 381-12, Threat Awareness
and Reporting Program (Washington, DC: Government Printing Office, 2016), i.
26
Annual TARP training is required for all Department of the Army (DA)
personnel.50 This training must be conducted by a trained CI agent to a live audience
unless the conditions are such live training is not possible.51 In these cases, Soldiers must
complete the online training that is available through the Army Learning Management
System website.52 The TARP training used is dictated by the Army G-2 and is
standardized across the Army. This training is called the stand alone briefing tool (SBT).
CI units will use the SBT to tailor TARP training to the audience and geographic area,53
which does provide limited flexibility on behalf of the CI agents for what is briefed
during the training. Aside from this annual briefing requirement, TARP does not specify
any additional insider threat training that is allowed.
According to TARP, all DA personnel with knowledge of insider threat-related
incidents must report these incidents to the proper CI authorities. Personnel who fail to
report are subject to punishment under the Uniformed Code of Military Justice (UCMJ),
as well as to adverse administrative or other adverse action authorized by applicable
provisions of the United States Code (USC) or Federal Regulations.54 Personnel not
subject to the UCMJ who fail to report are subject to adverse administrative action or
criminal prosecution as authorized by applicable provisions of the USC or Federal
50 US Department of the Army, AR 381-12, 6.
51 Ibid.
52 Ibid., 7.
53 Ibid., 6.
54 Ibid., 9.
27
Regulations. In short, all DA employees are required to report. TARP Chapter 4 outlines
the procedures for individuals to report CI incidents. They may make reports directly to
their resident CI office, and should limit knowledge of an incident to those who have an
absolute need to know.55
Chapter 3 of TARP lists the behavioral indicators of terrorist or extremist
activities. These indicators are listed in the two tables below (Table 3-2, Indicators of
potential international terrorist-associated insider threats; and Table 3-3, Indicators of
extremist activity that may pose a threat to Department of Defense or disrupt US military
operations).
55 US Department of the Army, AR 381-12, 14.
28
Figure 1. Indicators of potential international terrorist-associated insider threats Source: US Department of the Army, Army Regulation (AR) 381-12, Threat Awareness and Reporting Program (Washington, DC: Government Printing Office, 2016), 11.
Figure 2. Indicators of extremist activity that may pose a threat to Department of Defense or disrupt US military operations
Source: US Department of the Army, Army Regulation (AR) 381-12, Threat Awareness and Reporting Program (Washington, DC: Government Printing Office, 2016), 12.
29
These tables from Chapter 3 of TARP include a comprehensive list of threat
indicators that are required to be reported to CI personnel. With the exception of viewing
unauthorized websites that promote or support international terrorism, failure to report
any of these indicators could lead to adverse administrative or punitive actions. Although
failure to report could lead to negative actions, instances of this being used could not be
identified through available research.
In order to ensure effective implementation of TARP, AR 381-12 included an
Internal Control Evaluation section in Appendix B. This evaluation, which is required
annually each time a Command Inspection Program occurs, or at a minimum once every
five years, certifies that a unit is following the procedures outlined in TARP. There are
five questions that pertain directly to unit commanders at all levels, which are outlined
below. Have Army commanders –
1. . Established procedures to ensure that TARP training is scheduled for
members of their unit?
2. . Included the requirements of AR 381-12 as a mandatory subject in the
organizational inspection program?
3. . Established a process to track TARP training in their units?
4. . Established a process to track TARP training on their installation, if
appropriate?
5. . Maintained contact information for the supporting CI unit (identity of office,
names of CI agents, phone numbers, and e-mail addresses)?56
56 US Department of the Army, AR 381-12, 21.
30
AR 381-12 outlines TARP as the Army’s primary method of educating and
training the force to recognize and report potential insider threats. While it covers all CI
matters, it does specifically address activities associated with Soldiers with possible ties
to violent extremist or terrorist organizations. Its comprehensive list of behavioral
indicators identify actions a Soldier may display prior to conducting an act of targeted
violence against fellow service members. In addition, it clearly states the reporting
requirements of all DA employees, and articulates possible repercussions for failure to
report. While TARP lists some of the actions that are available to commanders, it is not
an all-encompassing list of every action a commander may take. However, these
additional actions are included in another regulation, AR 600-20, Army Command
Policy.
Options Available to Commanders
Limitations on Information Sharing
One of the challenges commanders face with identifying potential threats within
their formations is understanding what information about their Soldiers they are allowed
to access. The two primary documents limiting the sharing of personal information are
the Privacy Act of 1974 and the privacy regulations in the Health Insurance Portability
and Accountability Act (HIPAA) of 1996. In August 2012 the DOD Defense Science
Board released the Task Force Report: Predicting Violent Behavior. This study was one
of several reviews that resulted from the killings that took place on November 5, 2009 at
the Fort Hood, Texas Soldier Readiness Center.57 In it, the study found that there is a lack
57 Defense Science Board, Task Force Report: Predicting Violent Behavior
(Washington, DC: Office of the Under Secretary of Defense for Acquisition, Technology
31
of clarity and understanding among commanders, supervisors, and healthcare providers
regarding Privacy Act and HIPAA regulations on the releasability of information that
may be relevant to documenting and reporting concerning behavior.58 Part of the reason
for this is the complexity of both the Privacy Act and HIPAA.
Predicting Violent Behavior identified that in many cases involving acts of
targeted violence, the perpetrator displayed one or more of the following: contemplated
harming himself or others; was in need of help due to stressful life circumstances; was
otherwise isolated from his colleagues, depressed, or engaged in questionable
associations or activities.59 Relevant information might have been known to co-workers,
family or friends, or even supervisors or commanders.60 In some cases this information
was known to medical or law enforcement personnel.61 However, in many cases this
information was ignored, suppressed, or otherwise failed to result in any type of action.62
This is partially due to these different persons or organizations only having small pieces
of the full informational picture. Had this information been shared, compiled, and
analyzed by professionals it may have presented a compelling case for intervention.63
and Logistics, 2012), 1.
58 Defense Science Board, 1.
59 Ibid., 7.
60 Ibid.
61 Ibid.
62 Ibid.
63 Ibid., 8.
32
Whether the limitations on information sharing are real or perceived, the lack of
understanding leads to an abundance of caution and impedes information flow.64 The
default behavior is to not release any information that could potentially fall under the
Privacy Act or HIPAA.65
Organizational Relationships
The Privacy Act of 1974 and HIPAA are not the only factors that limit the sharing
of information. Predicting Violent Behavior found that commanders and supervisors do
not have sufficient visibility into personnel records of Soldiers transferring into their
command. Each new assignment effectively represents a “clean slate” whereby behaviors
of concern are not documented across assignments, patterns get lost, and prevention
becomes significantly more difficult.66 There is very little continuity of Soldier
counseling or disciplinary actions that transfer to a new command during a permanent
change of station (PCS) move.
The Task Force also found that the Military Departments, with the exception of
the Army, currently operate a centralized, combined intelligence, CI, and law
enforcement threat information sharing capability.67 This separation of these key entities
perpetuates failure and significantly limits an organization’s ability to accurately access
64 Defense Science Board, 8.
65 Ibid.
66 Ibid.
67 Ibid., 9.
33
the nature of any type of threat.68 Predicting Violent Behavior recommends that the
current relationship between the Army’s Intelligence and Security Command (INSCOM),
the Criminal Investigation Command (CID), and law enforcement should be revaluated
with the goal of operating in a more integrated manner without inserting organizational
boundaries as potential barriers to the rapid flow of relevant information.69
Command Policy
The Army’s doctrine for command policy is outlined in AR 600-20, dated 6
November 2014. The purpose of this regulation is to prescribe the policies and
responsibilities of command, which include the Army Ready and Resilient Campaign
(R2C) Plan, military discipline and conduct, the Army Equal Opportunity (EO) Program,
and the Army Sexual Harassment/Assault Response and Prevention (SHARP) Program.70
This regulation is divided into eight chapters: (1) Introduction, (2) Command Policies, (3)
Ready and Resilient, (4) Military Discipline and Conduct, (5) Other Responsibilities of
Command, (6) Equal Opportunity Program, (7) Prevention of Sexual Harassment, and (8)
Sexual Assault Prevention and Response Program. This paper will focus on chapter 4,
Military Discipline and Conduct, but will address other topics that help answer the
research questions of what options are available to commanders and how to compel
Soldiers to report.
68 Defense Science Board, 9.
69 Ibid.
70 US Department of the Army, Army Regulation (AR) 600-20, Army Command Policy (Washington, DC: Government Printing Office, 2014), 1.
34
The key elements of command are authority and responsibility.71 It is the
commander’s overall responsibility to establish a climate within the unit that allows for
the development of discipline and cohesion. In order to build a positive command
climate, leaders must consider their Soldiers’ needs and care for their well-being. Military
discipline is maintained through the commander’s authority of the use of the UCMJ.
Commanders strive to use the full range of human potential in their organization and
properly train their Soldiers to ensure both personnel and equipment are in the proper
state of readiness at all times.72
All commanding officers and others in authority in the Army are required: to
show in themselves a good example of virtue, honor, patriotism, and subordination; to be
vigilant in inspecting the conduct of all persons who are placed under their command; to
guard against and suppress all dissolute and immoral practices, and to correct, according
to the laws and regulations of the Army, all persons who are guilty of them; to take all
necessary and proper measures, under the laws, regulations, and customs of the Army;
and to promote and safeguard the moral, the physical well-being, and the general welfare
of the officers and enlisted persons under their command or charge.73 In short, they are
responsible for the overall well-being and good order and discipline of the unit.
Chapter 2 of Army Command Policy outlines command policies. Two of these
policies that are potential options available to commanders are the use of open door
71 US Department of the Army, AR 600-20, 2.
72 Ibid.
73 Ibid.
35
policies and performance counseling. Commanders are required to establish an open door
policy within their commands.74 The purpose of an open door policy is to ensure that the
commander is made aware of problems that affect the discipline, moral, and mission
effectiveness of a unit.75 It allows members of the command to present facts, concerns,
and problems of a personal or professional nature or other issues that the Soldier has been
unable to resolve.76 While commanders are responsible for establishing how the open
door policy is implemented, Soldiers are responsible for utilizing it to bring matters to the
commander. This is an important concept that will be discussed further in Chapter 4,
Analysis, of this paper.
Another policy stated in Army Command Policy is performance counseling.
Commanders need to ensure that all members of their command receive timely
performance counseling.77 Performance counseling can inform Soldiers and document on
paper their expectations of performance. In addition, this is an opportunity for leaders to
address any concerns in behavior that may be deemed unacceptable by the command and
the Army.
Army Command Policy Chapter 3 addresses the Ready and Resilient Campaign
(R2C). R2C is a far-reaching and comprehensive initiative to enhance individual and
74 US Department of the Army, AR 600-20, 6.
75 Ibid.
76 Ibid.
77 Ibid.
36
collective resilience in order to improve readiness across the Army.78 This initiative
integrates all of the external resources the Army can provide to improve physical,
psychological, and emotional health.79 R2C guides the Army’s efforts in cultivating a
holistic, multidisciplinary approach to health promotion.80 This initiative integrates and
synchronizes multiple Army-wide efforts to enhance individual performance and increase
overall unit readiness.81 R2C identifies mental health as a component of overall Soldier
readiness. This will be discussed further in Chapter 4 of this paper, specifically in regards
to the case study involving William Kreutzer, Jr and the mental health issues he faced.
The bulk of research into Army Command Policy regarding preventing insider
threat direct action attacks falls into Army Command Policy Chapter 4, Military
Discipline and Conduct. This chapter highlights the commander’s responsibility to
maintain good order and discipline in a unit and describes the commander’s roles and
responsibilities in this process. Military discipline will be developed by individual and
group training to create a mental attitude resulting in proper conduct and prompt
obedience to lawful military authority.82 It is manifested in individuals and units by
cohesion, bonding, and a spirit of teamwork; by smartness of appearance and action; by
cleanliness and maintenance of dress, equipment, and quarters; by deference to seniors
78 US Department of the Army, AR 600-20, 20.
79 Ibid.
80 Ibid.
81 Ibid.
82 Ibid., 23.
37
and mutual respect between senior and subordinate personnel; by the prompt and willing
execution of both the letter and the spirit of the legal orders of their lawful commanders;
and by fairness, justice, and equity for all Soldiers, regardless of race, religion, color,
gender, and national origin.83
Ensuring the proper conduct of Soldiers is a function of command.84 As such,
commanders must take action consistent with Army regulations and in any case where a
Soldier’s conduct violates good order and discipline.85 For minor infractions, Army
Command Policy states that commanders should consider administrative corrective
measures before deciding to impose nonjudicial punishment.86 Ways this can be
accomplished are through extra training, on-the-spot correction, or written counseling, to
name a few. For more serious offenses, commanders may resort directly to UCMJ
actions. If a Soldier commits a crime, commanders must submit a DA Form 4833
(Commander’s Report of Disciplinary or Administrative Action) to the Provost
Marshall’s Office (PMO) within 45 days of notification.87 In addition, if the Soldier holds
a security clearance, the unit security manager must submit the DA Form 4833 to the
83 US Department of the Army, AR 600-20, 23.
84 Ibid.
85 Ibid., 24.
86 Ibid.
87 Ibid.
38
DOD Consolidated Adjudication Facility via the Joint Personnel Adjudication System
(JPAS).88
Regarding potential insider threats, section 4-12 of Army Command Policy covers
extremist organizations and activities. This section reiterates that it is the commander’s
responsibility to maintain good order and discipline in the unit, and states that every
commander has the inherent authority to take appropriate actions to accomplish this
goal.89 Section 4-12 identifies prohibited actions by Soldiers involving extremist
organizations, discusses the authority of the commander to establish other prohibitions,
and established that violations of prohibitions contained in this section or those
established by the commander may result in prosecution under various provisions of the
UCMJ.90 Commanders must also use this section in conjunction with DOD Instruction
(DODI) 1325.06 (Handling Dissident and Protest Activities Among Members of the
Armed Forces).91
Army Command Policy states that military personnel must reject participation in
extremist organizations and activities.92 The following list defines extremist
organizations or activities as ones that advocate –
1. . Racial, gender, or ethnic hatred or intolerance.
88 US Department of the Army, AR 600-20, 25.
89 Ibid., 26.
90 Ibid.
91 Ibid.
92 Ibid.
39
2. . Creating or engaging in illegal discrimination based on race, color, gender,
religion, or national origin.
3. . The use of force or violence or unlawful means to deprive individuals of
their rights under the United States Constitution or the laws of the United
States, or any State.
4. . Support for terrorist organizations or objectives.
5. . The use of unlawful violence or force to achieve goals that are political,
religious, or ideological in nature.
6. . Expressing a duty to engage in violence against DOD or the United States in
support of a terrorist or extremist cause.
7. . Support for persons or organizations that promote or threaten the unlawful
use of force or violence.
8. . Encouraging military or civilian personnel to violate laws or disobey lawful
orders or regulations for the purpose of disrupting military activities
(subversion).
9. 9. Participating in activities advocating or teaching the overthrow of the US
Government by force or violence, or seeking to alter the form of government
by unconstitutional means (sedition).93
Any Soldier that participates any of the aforementioned activities is subject to
punitive actions under the UCMJ. It is both the commander’s authority and prerogative to
prohibit military personnel from engaging in any other activities that the commander
93 US Department of the Army, AR 600-20, 26.
40
determines will adversely affect good order and discipline or moral within the
command.94 The following are options that are available to the commander for dealing
with a Soldier’s violation of the prohibitions mentioned above:
1. UCMJ action – Possible violations include the following:
a. Article 92 – Violation or failure to obey a lawful general order or
regulation.
b. Article 116 – Riot or breach of peace.
c. Article 117 – Provoking speeches or gestures.
d. Article 134 – General article, specifically, conduct which is prejudicial
to good order and discipline or service discrediting.
2. Involuntary separation for unsatisfactory performance or misconduct, or for
conduct deemed prejudicial to good order and discipline or moral.
3. Reclassification actions or bar to reenlistment actions, as appropriate.
4. Other administrative or disciplinary action deemed appropriate by the
commander, based on the specific facts and circumstances of the particular
case.95
The nonjudicial punishment authority for commanders rests in Article 15, UCMJ
and Part V, Military Manual for Courts-Martial (MCM).96 The use of nonjudicial
punishment is proper in all cases involving minor offenses in which non-punitive
94 US Department of the Army, AR 600-20, 26.
95 Ibid., 27.
96 US Department of the Army, Army Regulation (AR) 27-10, Military Justice (Washington, DC: Government Printing Office, 2011), 3.
41
measures are considered inadequate or inappropriate.97 Nonjudicial punishment is meant
to be used by commanders as a corrective measure to fix behaviors. If a commander
determines that the commander’s authority under UCMJ, Article 15 is insufficient to
impose a proper punishment, the case may be referred to an appropriate superior.98 Table
3 illustrates the types of nonjudicial punishment under Article 15 and the maximum
punishments available under each type.
Figure 3. Maximum Punishments in Article 15 Source: Army Study Guide, accessed 24 January 2017, http://www.armystudyguide.com/ content/army_board_study_guide_topics/military_justice/about-article-15.shtml.
97 US Department of the Army, AR 27-10, 3.
98 Ibid., 4.
42
According to Army Command Policy, it is the commander’s responsibility to take
positive actions to educate Soldiers and put them on notice of the potential adverse
effects participation in extremist organizations and activities.99 These positive actions
include educating Soldiers regarding the Army’s EO policy, and that extremist
organizations’ goals are inconsistent with Army goals, beliefs, and values.100 In addition,
commanders must advise Soldiers that participation in extremist organizations or
activities will have negative effects on their careers. Some of these negative effects are
reflections on their evaluation reports, potential removal of security clearances,
reclassification actions, bars from reenlistment, or reports to law enforcement
authorities.101
Commanders are also required to notify their supporting CI organization in cases
where they know or suspect that Soldiers are engaging in activities specified above or
when they become aware of any activities outlined in AR 381-12 (TARP). It is important
for commanders to maintain contact information for their supporting CI unit.102 In cases
where a Soldier has a security clearance, commanders are required to ensure their unit
security manager submits the derogatory information as an incident report in the JPAS.103
99 US Department of the Army, AR 600-20, 27.
100 Ibid.
101 Ibid.
102 US Department of the Army, AR 381-12, 21.
103 US Department of the Army, AR 600-20, 27.
43
Chapter 5 of Army Command Policy outlines other responsibilities of command.
One of these other responsibilities are the command aspects of medical care, under which
mental health requirements are referenced. When a commander determines it is necessary
to refer a Soldier for a mental health evaluation, the commander will ensure compliance
with the provisions of DODI 6490.01 (Mental Health Evaluations of members of the
Armed Forces), which limits the use of mental health evaluations in situations where
adversarial actions are involved.104 According to DODI 6490.01, the responsibility for
determining whether or not a referral for mental health evaluation should be made rests
with the service member’s designated commanding officer at the time of the referral.105 If
a Soldier through actions or words commits, attempts, or threatens the use of violence
that is likely to cause serious injury to himself, herself, or others the commander shall
refer that Soldier for an emergency mental health evaluation as soon as practically
possible.106 If a Soldier is determined not to meet retention standards, a medical board
report shall be forwarded to the Services’ Physical Evaluation Board for determination of
fitness for continued military service.107
When a privileged mental healthcare provider makes a recommendation to the
commander, the commanding officer shall make a written record of the actions taken and
104 US Department of the Army, AR 600-20, 37-38.
105 US Department of Defense, Department of Defense Directive (DODI) 6490.1, Mental Health Evaluations of Members of the Armed Forces (Washington, DC: Government Printing Office, 2003), 2.
106 Ibid., 3.
107 Ibid., 6.
44
reasons therefore.108 If the healthcare provider recommends that the Soldier be separated
from the Army due to a personality disorder and a pattern of potentially dangerous
behavior (more than one episode), that recommendation shall be co-signed by the mental
healthcare provider’s commanding officer.109 The Soldier’s commander then has the
opportunity to follow or decline the healthcare provider’s recommendations.
Other responsibilities of command discuss the accommodation of religious
practices. This section states that commanders are required to accommodate Soldiers’
worship, dietary, medical, and grooming practices in addition to wear and appearance of
the uniform in accordance with their preferred religion.110 However, these practices must
not interfere with military operations or the good order and discipline of the unit. The
remainder of Army Command Policy deals with the Army’s Equal Opportunity Program
(EO), Prevention of Sexual Harassment (POSH), and the Sexual Assault Prevention and
Response Program (SHARP).
Overall, Army Command Policy and its supporting instructional references offer
commanders a wide range of options when dealing with a Soldier who is a potential
threat to fellow members in the unit. Some possible administrative actions are on-the-spot
corrections, performance counseling, evaluations, administrative separations,
reclassification, or bars to reenlistment. If the Soldier possesses a security clearance, the
commander may have the clearance suspended or removed. Another option available to
108 US Department of Defense, DODI 6490.1, 7.
109 Ibid.
110 US Department of the Army, AR 600-20, 45.
45
commanders is to refer the Soldier to Behavioral Health for a mental health evaluation. If
deemed unfit for service, the Soldier may be separated from the Army for psychiatric
means.
If necessary, the commander has the option of seeking punitive actions through
the use of UCMJ. The four articles of UCMJ the Soldier could potentially face are:
Article 92, failure to obey a lawful general order; Article 116, riot or breech of peace;
Article 117, provoking speeches or gestures; and Article 134, general article, specifically
conduct which is prejudicial to good order and discipline or service discrediting. Army
Command Policy recommends that commanders seek administrative corrective measures
first, but if the Soldier directly violates any of the articles of UCMJ stated above the
commander has the option of going directly to punitive actions.
Lastly, the commander may refer the Soldier to law enforcement where a serious
crime outside the commander’s purview is committed. In any case, any of the indicators
of violent or extremist activity outlined above or in AR 381-12 must be reported to the
supporting counterintelligence unit. A failure to report is a failure to follow Army
Command Policy.
Chapter Summary
This chapter examined the literature available surrounding the two insider threat
case studies of William Kreutzer, Jr. and Nidal Hasan, the Army’s TARP requirements,
potential friction points in the flow of information, and the responsibilities of command
and options available to commanders as outlined in Army Command Policy in order to
answer the primary research question: How does the Army compel Soldiers to report
insider threats to the proper authorities? In both case studies, Army personnel had first-
46
hand knowledge of threat indicators as outlined in TARP and failed to report. In addition,
commanders did not use the wide range of options available to them in the handling of
high-risk individuals.
TARP is an all-inclusive regulation that covers the full spectrum of insider
threats. The research in this paper focused on the Army’s requirements for all Soldiers to
report, the indicators of violent/extremist behavior, and the responsibilities of
commanders in the implementation of TARP. Army Command Policy outlines the
responsibilities of command and some options that are available to commanders to
maintain good order and discipline in a unit. Commanders must also take into account
privacy restrictions imposed on them by the Privacy Act of 1974 and HIPAA. Finally, the
research discussed limitations on information sharing between different organizations.
Information critical to identifying potential insider threats sometimes gets lost between
Soldier PCS moves, as well as between the different organizations both inside and
external to the Department of the Army.
In Chapter 3: Methodology, this paper will explain how the primary research
question will be answered through examination of the two case studies and whether or
not commanders exercised their given command authority.
47
CHAPTER 3
RESEARCH METHODOLOGY
Chapter Introduction
This chapter serves to describe the steps to answer the primary research question:
How does the Army compel Soldiers to report suspicious activity involving insider
threats? Does the Army’s mandatory Threat Awareness and Reporting Program (TARP)
training effectively prevent direct action by insider threats? What are TARP's goals, and
what should it provide? What options are available to commanders who identified
potential insider threats within their organizations? Two case studies will be examined,
focusing on the Fort Bragg shooting of October 27, 1995 and the Fort Hood shooting of
November 5, 2009.
The study used a qualitative methodology with a case study research design in
order to understand the complexities involved with countering insider threats. The large
amount of data sources available lends itself to this type of research. Qualitative case
study is an approach to research that facilitates exploration of a phenomenon within its
context using a variety of data sources.111 The phenomenon explored in this study is
direct action attacks carried out by insider threats. In order to answer the primary and
secondary research questions, research could not be limited to just understanding the
circumstances of the two attacks. Army policies and regulations also had to be considered
111 Pamela Baxter and Susan Jack. “Qualitative Case Study Methodology: Study
Design and Implementation for Novice Researchers.” The Qualitative Report 13, no. 4 (December 2008): 544, accessed 19 April 2017, http://www.nova.edu/ssss/ QR/QR13-4/baxter.pdf.
48
when analyzing the two case studies, as these documents lay the foundation of countering
insider threats. Case study analysis enables the researcher to gather data from a variety of
sources and to converge the data to illuminate the case.112
Why These Case Studies?
The Fort Bragg case study is useful because the shooter’s motivations in this
instance are not based on religious ideology or beliefs. Since the terrorist attacks on
September 11, 2001, the majority of focus on insider threat direct action attacks have
been primarily on identifying threats who have been radicalized in religious beliefs,
either through self-radicalization or through external influence. However, it is important
to highlight the fact that not all insider threats are based on fundamental Islamic
extremism.
In this case Army Sergeant William Kreutzer had no ties to what would
traditionally be called terrorist activities. Instead, Kreutzer lived a life of feeling like an
outsider, and the stresses involved with this eventually led him to a state of mental
instability. In the years and months leading up to the attack, Kreutzer repeatedly
threatened to kill his fellow service members and superiors, but no one around him took
him seriously. His commander at one point referred him to seek help from a psychiatrist,
but the Army psychiatrist dismissed him as not a real threat. Despite all of the indicators,
at no point was Kreutzer reported to Army CI or CID.
The Fort Hood case study is useful for this study because of the large amount of
information available on it. The severity of this case is due in part to the large number of
112 Baxter and Jack, 556.
49
casualties that resulted from Hasan’s actions. As a result, follow-on investigations and
reports eventually led to modifications in how the Army looked at dealing with insider
threats.
This is a case where fundamental Islamic extremist beliefs did play a role in the
motivations for the attack. Nidal Hasan openly stated he was a conscientious objector,
and that he was not willing to deploy to fight in Muslim countries. He also stated on
multiple occasions that he saw violence against Americans as justified due to what he
perceived as a war against Islam. As with the Fort Bragg case study, there were multiple
opportunities for Hasan’s fellow Soldiers and commanders to act upon the violent
indicators he displayed. However, his commanders took no action and failed to report
him to Army CI or law enforcement agencies.
Education
A key element of research for answering how the Army can compel Soldiers to
report is understanding how Soldiers are trained and educated on reporting indicators of
insider threat. The primary doctrine governing education on insider threats is Army
Regulation 381-12, Threat Awareness and Reporting Program (TARP). This thesis will
identify the training requirements outlined in TARP and try to determine if this
mandatory training is sufficient enable Soldiers to not only recognize the indicators, but
also to know to where and whom to report. This thesis will also identify what
punishments, if any, are available should Soldiers fail to report.
50
Options Available to Commanders
One of the main topics this thesis is designed to clarify is what options are
available to commanders who identify they have a high-risk Soldier within their
formation. Commanders put into this scenario face a dilemma. What is the threshold for
reporting the Soldier to Army Counterintelligence? What are the effects on the unit if the
Soldier’s access to firearms is removed? If the Soldier is simply moved to another unit,
what are the potential consequences? What kind of help from outside the organization,
such as behavioral health counseling, is available? What are the legal restrictions facing
the commander and how might the commander gain access to derogatory information
from previous assignments?
This thesis will explore all of these questions through current Army doctrine and
regulations, namely Army Command Policy, Conscientious Objection, Suspension of
Favorable Personnel Actions, and Administrative Separations. In addition, this thesis will
identify restrictions placed on the commander by the Privacy Act of 1974 and the Health
Insurance Portability and Accountability Act of 1996 (HIPAA).
Analytical Model
In order to answer the primary research question and assess how the Army could
have compelled reporting, each case study conducts a qualitative analysis of seven
variables:
1. TARP indicators of potential international terrorist-associated insider
threats113;
113 Department of the Army, AR 381-12, 11.
51
2. TARP indicators of extremist activity that may pose a threat to the
Department of Defense or disrupt US military operations114;
3. Participation in extremist organizations and activities as defined by Army
Command Policy115;
4. Possible UCMJ violations for participation in extremist organizations or
activities116;
5. Administrative actions available to commanders117;
6. Punitive actions available to commanders118; and
7. Other actions available to commanders119.
Each of the seven variables will be broken down into sub-variables, which are
shown in Tables 1-7 below. The sub-variables will be assigned a (+) if it presented itself
in the case study or a commander used that option that was available to him/her. A (-)
will be assigned if this variable did not present itself or if the commander did not follow
through with that particular action. This information will be used to determine two things:
(1) Did the Soldier who committed an act of targeted violence present indicators of
violent tendencies prior to the attack, and (2) Did the commander use all available
114 Department of the Army, AR 381-12, 12.
115 Department of the Army, AR 600-20, 26.
116 Ibid., 27.
117 Ibid., 6.
118 Ibid., 27.
119 Ibid., 35-37.
52
options available to try and prevent the attack? A subjective qualitative assessment will
be made on each of the two case studies and be presented at the conclusion of chapter 4.
Table 1. Sub-variables of TARP Indicators of Potential International Terrorist-Associated Insider Threats
Source: Created by author.
Indicator Kreutzer HasanAdvocating support for ITOs or objectivesExpressing a hatred of American society, culture, government, or principles of the US Constitution that implies support for or connection to an ITOAdvocating the use of unlawful violence or force to achieve goals that are political, religious, or ideological in natureSending large amounts of money to persons or financial institutions in foreign countriesExpressing a duty to engage in violence against DOD or the United States in support of an international terrorist causeProcuring supplies and equipment, purchasing bomb making materials, or obtaining information about the construction and use of explosive devicesExpressing support for persons or organizations that promote or threaten the unlawful use of force or violenceAdvocating loyalty to a foreign interest over loyalty to the United StatesFinancial contribution or other material support to a foreign charity or other foreign cause linked to support to an ITOEvidence of training with or attendance at training facilities of ITOsAny attempt to recruit personnel on behalf of a known or suspected ITO or for terrorist activitiesFamilial ties or other close associations to known or suspected members of an ITO or those supporting terrorismRepeated viewing, without official sanction, of Internet Web sites that promote or support international terrorist themesPosting comments or exchanging information, without official sanction, at Internet chat rooms, message boards, or blogs that promote the use of force directed against the United StatesJoking or bragging about working for a foreign intelligence service or associating with international terrorist activities
1. TARP indicators of potential international terrorist-associated insider threats
53
Table 2. Sub-variables of TARP Indicators of Extremist Activity
Source: Created by author.
Indicator Kreutzer HasanReceiving financial assistance from a person who advocates the use of violence to undermine or disrupt US military operations or foreign policy
Soliciting advice, encouragement, finances, training, or other resources from a person who advocates the use of unlawful violence to undermine or disrupt US military operations or foreign policy
Making a financial contribution to a foreign charity, an organization, or cause that advocates the use of unlawful violence to undermine or disrupt US military operations or foreign policyExpressing a political, religious, or ideological obligation to engage in unlawful violence directed against US military operations or foreign policyExpressing support for foreign persons or organizations that promote or threaten the use of unlawful force or violence to achieve political, ideological, or religious objectivesParticipation in political demonstrations that promote or threaten the use of unlawful violence directed against the Army, DOD, or the United States based on political, ideological, or religious tenets, principles, or beliefs
2. TARP Indicators of extremist activity that may pose a threat to the Department of Defense or disrupt US military operations
54
Table 3. Sub-variables of Participation in Extremist Organizations and
Activities as Defined by Army Command Policy
Source: Created by author.
Table 4. Sub-variables of UCMJ Violations
Participation or activity Kreutzer HasanRacial, gender, or ethnic hatred or intoleranceCreating or engaging in illegal discrimination based on race, color, gender, religion, or national originThe use of force or violence or unlawful means to deprive individuals of their rights under the United States Constitution of the laws of the United States, or any StateSupport for terrorist organizations or objectivesThe use of unlawful violence or force to achieve goals that are political, religious, or ideological in natureExpressing a duty to engage in violence against DOD or the United States in support of a terrorist or extremist causeSupport for persons or organizations that promote or threaten the unlawful use of force or violenceEncouraging military or civilian personnel to violate laws or disobey lawful orders or regulations for the purpose of disrupting military activities (subversion)Participating in activities advocating or teaching the overthrow of the US Government by force or violence, or seeking to alter the form of government by unconstitutional means (sedition)
3. Participation in extremist organizations and activities as defined by Army Command Policy
UCMJ Violation Committed Kreutzer HasanArticle 92: Violation or failure to obey a lawful general order or regulationArticle 116: Riot or breach of peaceArticle 117: Provoking speeches or gesturesArticle 134: General article, specifically, conduct which is prejudicial to good order and discipline or service discrediting
UCMJ Violation Prosecuted through Nonjudicial Punishment Kreutzer HasanArticle 92: Violation or failure to obey a lawful general order or regulationArticle 116: Riot or breach of peaceArticle 117: Provoking speeches or gesturesArticle 134: General article, specifically, conduct which is prejudicial to good order and discipline or service discrediting
4. Possible UCMJ violations for participation in extremist organizations or activities
55
Source: Created by author.
Table 5. Sub-variables of Administrative Actions Available to Commanders
Source: Created by author.
Table 6. Sub-variables of Punitive Actions Available to Commanders
Source: Created by author.
Table 7. Sub-variables of Other Actions Available to Commanders
Administrative action Kreutzer HasanOn-the-spot correctionsPerformance counseling (written)Performance counseling (verbal)Evaluation ReportsExtra trainingFlag or bar to reenlistmentReclassificationReassignmentInvoluntary separation for unsatisfactory performance or misconduct, or for conduct deemed prejudicial to good order and discipline or service discreditingSubmit an incident report in the JPAS
5. Administrative actions available to commanders
Punitive action prior to attack Kreutzer HasanSummarized Article 15Company Grade Article 15Field Grade Article 15Recommend Trial by Courts-Martial
6. Punitive actions available to commanders
Other actions available Kreutzer HasanUse of an open door policyCommand referral to Behavioral HealthReport to Army CIReport to law enforcement
7. Other actions available to commanders
56
Source: Created by author.
Threats to Validity
There are several biases the author brings to this research. His experiences as a
Battalion Intelligence Officer targeting violent extremists in Iraq, and as a
Counterintelligence company commander, creates biases and threats to the “internal
validity” in this research.
The selection of the two case studies, which will be discussed in detail in chapter
4, Data Presentation and Analysis, also brings some bias. These case studies were
selected based off the amount of information available, the author’s interest in the case
studies, and the circumstances around the motivations of the attackers. The author did not
want to pick case studies that are solely based around Islamic extremism in order to
highlight the fact that potential insider threats can come from any demographic of service
members. Due to the limited number of case studies analyzed, there is a threat to
“external validity” based on generalizing conclusions from a sample of many potential
case studies.
The final threat to validity is in the case studies themselves. In the time between
the most recent case study and when this research was conducted, the Army updated its
insider threat doctrine from Subversion and Espionage Directed Against the Army
(SAEDA) to the Threat Awareness and Reporting Program (TARP). Part of this change
was a direct result of the Fort Hood terrorist attack, and identifying the effectiveness of
the new TARP is a secondary research question that will be difficult to answer.
57
Chapter Summary
This chapter outlines two major case studies and current Army doctrine to answer
the research question: How does the Army compel Soldiers to report suspicious activities
involving insider threat? The case studies are SGT William Kreutzer, Jr and MAJ Nidal
Malik Hasan. The Army doctrine and regulations are Army Command Policy,
Suspension of Favorable Personnel Actions, and Administrative Separations, in addition
to the Privacy Act of 1974 and HIPAA of 1996. These case studies and regulations will
be analyzed to answer the research question and determine if current training is sufficient
to prevent future insider threat direct action attacks.
In order to answer the primary research question and assess how the Army could
have compelled reporting, each case study conducts will analyze the variables of:
1. TARP indicators of potential international terrorist-associated insider threats;
2. TARP indicators of extremist activity that may pose a threat to the
Department of Defense or disrupt US military operations;
3. Participation in extremist organizations and activities as defined by Army
Command Policy;
4. Possible UCMJ violations for participation in extremist organizations or
activities;
5. Administrative actions available to commanders;
6. Punitive actions available to commanders; and
7. Other actions available to commanders.
58
Chapter 4, Data Presentation and Analysis, will examine these case studies and
regulations in depth, followed by Chapter 5, Conclusions, where final recommendations
will be presented.
59
CHAPTER 4
DATA PRESENTATION AND ANALYSIS
Chapter Introduction
The primary research question for the following case studies is: How does the
Army compel Soldiers to report activities associated with insider threat direct action
attacks to the proper authorities? Secondary research questions that will be considered for
these case studies are:
1. Does the Army’s TARP training effectively prevent direct action attacks by
insider threats?
2. What are TARP’s goals, and what should it provide?
3. What actions are available to commanders who identify potential insider
threats within their organizations?
Each case study will be qualitatively analyzed using seven variables that consist
of indicators presented according to TARP and Army Command Policy, possible punitive
violations as outlined by the UCMJ, along with administrative, punitive, and other
actions that commanders either acted upon or failed to act upon. Each variable consists of
multiple sub-variables that are derived from: AR 381-12, TARP; AR 600-20, Army
Command Policy, and AR 27-10, Military Justice.
Qualitative Analysis
Each of the seven variables used for this qualitative analysis contain several sub-
variables. The first two variables (TARP indicators of potential international terrorist-
associated insider threats and TARP indicators of extremist activity that may pose a
60
threat to the DOD or disrupt US military operations) contain the indicators of these types
of threats as outlined in TARP, AR 381-12. Variable 3, Participation in extremist
organizations and activities as defined by Army Command Policy, is broken down into
the activities that indicate possible participation in extremist organizations. Variable 4
shows which articles of UCMJ were violated in each case study, as well as whether or not
these violations of UCMJ were prosecuted through nonjudicial punishment. Variable 5
consists of administrative actions that were available to the commanders involved in
these case studies, and Variable 6 are the punitive actions that commanders could have
used. Variable 7 shows a list of other actions that were available to the commanders.
Each variable assessed in the case studies received a (+) or a (-) value to show
whether or not the variable was present or used in each case study. For variables one
through three, a (+) indicates the perpetrator of the attack displayed those behaviors prior
to the attack. A (-) indicates the attacker did not display that behavior. Variable four is
broken down into two parts. For the first part, a (+) indicates that the attacker violated
that particular violation under the UCMJ. For the second part, a (+) indicates the
commander prosecuted that UCMJ violation, while a (-) indicates the commander took no
disciplinary action. Variables five through seven are actions that were available to the
commanders in each case. A (+) indicates the commander used that option, while a (-)
indicates the commander did not use that option available.
Variable 1: TARP indicators of potential international terrorist-associated insider threats
Variable 1 consists of the fifteen different indicators of potential international
terrorist-associated insider threats as outlined in TARP. The key word to highlight from
61
this variable is international, which implies ties to a foreign nexus. A foreign nexus,
whether it be an organization, an individual, or an ideology, means these indicators fall
under the purview of Army counterintelligence. In the case of William Kreutzer, he did
not present any of the indicators associated with ties to an international terrorist
organization (ITO).
However, Nidal Hasan did present seven out of the fifteen possible indicators. In
the years leading up to the attack on Fort Hood, Hasan presented the following indicators
that are reportable under TARP: advocating support for ITOs or objectives; expressing a
hatred of American society, culture, government, or principles of the US Constitution that
implies support for or a connection to an ITO; advocating the use of unlawful violence or
force to achieve goals that are political, religious, or ideological in nature; expressing a
duty to engage in violence against DOD or the United States in support of an
international terrorist cause; expressing support for persons or organizations that promote
or threaten the unlawful use of force or violence; advocating loyalty to a foreign interest
over loyalty to the United States; and repeated viewing, without official sanction, of
Internet Web sites that promote or support international terrorist themes. The following
table shows a comparison of these variables in the two case studies:
62
Table 8. TARP Indicators of Potential International Terrorist-Associated Insider Threats
Source: Created by author.
Variable 2: TARP indicators of extremist activity that may pose a threat to the Department of Defense or disrupt US military operations
Variable 2 consists of six indicators of extremist activity that may pose a threat to
the United States or US military operations. As with Variable 1, Kreutzer did not display
Indicator Kreutzer HasanAdvocating support for ITOs or objectives (-) (+)Expressing a hatred of American society, culture, government, or principles of the US Constitution that implies support for or connection to an ITO
(-) (+)
Advocating the use of unlawful violence or force to achieve goals that are political, religious, or ideological in nature
(-) (+)
Sending large amounts of money to persons or financial institutions in foreign countries
(-) (-)
Expressing a duty to engage in violence against DOD or the United States in support of an international terrorist cause
(-) (+)
Procuring supplies and equipment, purchasing bomb making materials, or obtaining information about the construction and use of explosive devices
(-) (-)
Expressing support for persons or organizations that promote or threaten the unlawful use of force or violence
(-) (+)
Advocating loyalty to a foreign interest over loyalty to the United States
(-) (+)
Financial contribution or other material support to a foreign charity or other foreign cause linked to support to an ITO
(-) (-)
Evidence of training with or attendance at training facilities of ITOs (-) (-)Any attempt to recruit personnel on behalf of a known or suspected ITO or for terrorist activities
(-) (-)
Familial ties or other close associations to known or suspected members of an ITO or those supporting terrorism
(-) (-)
Repeated viewing, without official sanction, of Internet Web sites that promote or support international terrorist themes
(-) (+)
Posting comments or exchanging information, without official sanction, at Internet chat rooms, message boards, or blogs that promote the use of force directed against the United States
(-) (-)
Joking or bragging about working for a foreign intelligence service or associating with international terrorist activities
(-) (-)
1. TARP indicators of potential international terrorist-associated insider threats
63
any of the indicators of extremist activity as outlined in TARP. Nidal Hasan, on the other
hand, displayed three of the six indicators: soliciting advice, encouragement, finances,
training, or other resources from a person who advocates the use of unlawful violence to
undermine or disrupt US military operations or foreign policy; expressing a political,
religious, or ideological obligation to engage in unlawful violence directed against US
military operations or foreign policy; and expressing support for foreign persons or
organizations that promote or threaten the use of unlawful force or violence to achieve
political, ideological, or religious objectives.
For the first variable, Hasan communicated with a known terrorist abroad on
multiple occasions. Although the Army was unaware of these communications, the FBI
monitored and tracked them. However, this information was never coordinated or passed
to Army CI. In addition, Hasan tried to justify terrorism and stated support to foreign
terrorist organizations in multiple class presentations. The following table shows a
comparison of these variables in the two case studies:
64
Table 9. TARP Indicators of Extremist Activity That May Pose a Threat to the Department of Defense or Disrupt US Military Operations
Source: Created by author.
Variable 3: participation in extremist organizations and activities as defined by Army Command Policy
Variable 3 consists of nine indicators associated with participation in extremist
organizations and activities as defined by Army Command Policy. Any commander with
a Soldier who displays any of these indicators is required to act on them in order to
maintain the good order and discipline of the unit. William Kreutzer did display one of
these indicators on multiple occasions: the use of force or violence or unlawful means to
deprive individuals of their rights under the US Constitution or the laws of the United
States, or any State. He did this when he openly made threats to kill fellow Soldiers.
Indicator Kreutzer HasanReceiving financial assistance from a person who advocates the use of violence to undermine or disrupt US military operations or foreign policy
(-) (-)
Soliciting advice, encouragement, finances, training, or other resources from a person who advocates the use of unlawful violence to undermine or disrupt US military operations or foreign policy
(-) (+)
Making a financial contribution to a foreign charity, an organization, or cause that advocates the use of unlawful violence to undermine or disrupt US military operations or foreign policy
(-) (-)
Expressing a political, religious, or ideological obligation to engage in unlawful violence directed against US military operations or foreign policy
(-) (+)
Expressing support for foreign persons or organizations that promote or threaten the use of unlawful force or violence to achieve political, ideological, or religious objectives
(-) (+)
Participation in political demonstrations that promote or threaten the use of unlawful violence directed against the Army, DOD, or the United States based on political, ideological, or religious tenets, principles, or beliefs
(-) (-)
2. TARP Indicators of extremist activity that may pose a threat to the Department of Defense or disrupt US military operations
65
Nidal Hasan presented five of the nine indicators outlined in Army Command
Policy: the use of force or violence or unlawful means to deprive individuals of their
rights under the US Constitution or the laws of the United States, or any State; support
for terrorist organizations or objectives; the use of unlawful violence or force to achieve
goals that are political, religious, or ideological in nature; expressing a duty to engage in
violence against DOD or the United States in support of a terrorist or extremist cause;
support for persons or organizations that promote or threaten the unlawful use of force or
violence. The following table shows a comparison of these variables in the two case
studies:
Table 10. Participation in Extremist Organizations and Activities as Defined by Army Command Policy
Source: Created by author.
Participation or activity Kreutzer HasanRacial, gender, or ethnic hatred or intolerance (-) (-)Creating or engaging in illegal discrimination based on race, color, gender, religion, or national origin
(-) (-)
The use of force or violence or unlawful means to deprive individuals of their rights under the United States Constitution of the laws of the United States, or any State
(+) (+)
Support for terrorist organizations or objectives (-) (+)The use of unlawful violence or force to achieve goals that are political, religious, or ideological in nature
(-) (+)
Expressing a duty to engage in violence against DOD or the United States in support of a terrorist or extremist cause
(-) (+)
Support for persons or organizations that promote or threaten the unlawful use of force or violence
(-) (+)
Encouraging military or civilian personnel to violate laws or disobey lawful orders or regulations for the purpose of disrupting military activities (subversion)
(-) (-)
Participating in activities advocating or teaching the overthrow of the US Government by force or violence, or seeking to alter the form of government by unconstitutional means (sedition)
(-) (-)
3. Participation in extremist organizations and activities as defined by Army Command Policy
66
Variable 4: Possible UCMJ violations for participation in extremist organizations or activities
There are four articles of UCMJ that pertain to the previous three variables used
in this analysis. They are: Article 92, violation or failure to obey a lawful general order or
regulation; Article 116, riot or breach of peace; Article 117, provoking speeches or
gestures; and Article 134, general article, specifically, conduct which is prejudicial to
good order and discipline or service discrediting. In both case studies, the perpetrators
violated more than one of the articles of UCMJ previously mentioned. Kreutzer violated
Articles 117 and 134, while Hasan violated Articles 92, 117, and 134. In both case
studies, no commander at any level pursued nonjudicial punishment for violation of any
of these articles, as seen in the table below:
Table 11. Possible UCMJ Violations for Participation in Extremist Organizations or Activities
Source: Created by author.
UCMJ Violation Committed Kreutzer HasanArticle 92: Violation or failure to obey a lawful general order or regulation
(-) (+)
Article 116: Riot or breach of peace (-) (-)Article 117: Provoking speeches or gestures (+) (+)Article 134: General article, specifically, conduct which is prejudicial to good order and discipline or service discrediting
(+) (+)
UCMJ Violation Prosecuted through Nonjudicial Punishment Kreutzer HasanArticle 92: Violation or failure to obey a lawful general order or regulation
(-) (-)
Article 116: Riot or breach of peace (-) (-)Article 117: Provoking speeches or gestures (-) (-)Article 134: General article, specifically, conduct which is prejudicial to good order and discipline or service discrediting
(-) (-)
4. Possible UCMJ violations for participation in extremist organizations or activities
67
Variable 5: Administrative actions available to commanders
Variable 5 looks at all of the administrative actions that were available to the
commanders involved in both case studies. These options are primarily outlined in Army
Command Policy and TARP, but some are also derived from other Army regulations. For
this analysis, ten different options were used to determine which ones the commanders
used in each case study. In the Kreutzer case study, information on all ten variables was
not available. However, in the information that was available, it was found that only two
administrative actions were used: performance counseling (verbal) and reassignment. The
effectiveness of these two administrative actions (or lack thereof) is apparent, but will be
discussed further in Chapter 5. In the Hasan case study, only three of the ten
administrative actions were used: on-the-spot corrections, performance counseling
(verbal), and extra training. The comparison of administrative actions used in the two
case studies are shown in the table below:
Table 12. Administrative Actions Available to Commanders
Source: Created by author.
Administrative action Kreutzer HasanOn-the-spot corrections * (+)Performance counseling (written) * *Performance counseling (verbal) (+) (+)Evaluation Reports * (-)Extra training * (+)Flag or bar to reenlistment (-) (-)Reclassification (-) (-)Reassignment (+) (-)Involuntary separation for unsatisfactory performance or misconduct, or for conduct deemed prejudicial to good order and discipline or service discrediting
(-) (-)
Submit an incident report in the JPAS (-) (-)*Information not available in the research.
5. Administrative actions available to commanders
68
Variable 6: Punitive actions available to commanders
There are four levels of punitive actions commanders can utilize for violations of
UCMJ. The level of punitive action would be determined by the commander based off
the severity of the actions or violations of UCMJ the Soldier committed. Summarized
Article 15, Company Grade Article 15, and Field Grade Article 15’s are used as
corrective measures to fix Soldier deficiencies. When a commander deems the severity of
an offense warrants more severe punishment, he/she may recommend a trial by courts-
martial.
In the case of William Kreutzner, all four of these levels of punitive actions could
have been used. However, Kreutzer did not face any nonjudicial punishment prior to his
attack on Fort Bragg. Nidal Hasan’s commanders did not have all four options available
to them. Due to Hasan’s rank, any nonjudicial punishment would be a minimum of a
Field Grade Article 15. As with the Kreutzer case, Hasan did not face any nonjudicial
punishment for his actions prior to the attack on Fort Hood. The punitive actions
available to the commanders in both case studies are listed in the table below:
Table 13. Punitive Actions Available to Commanders
Source: Created by author.
Punitive action prior to attack Kreutzer HasanSummarized Article 15 (-) N/ACompany Grade Article 15 (-) N/AField Grade Article 15 (-) (-)Recommend Trial by Courts-Martial (-) (-)
6. Punitive actions available to commanders
69
Variable 7: Other actions available to commanders
The research in this study found five additional options that are available to
commanders when they identify potential insider threats within their formations. The first
is the use of an open door policy. Having an open door policy is mandated by Army
Command Policy. It allows Soldiers the opportunity to address issues within a unit that
may impact the outcome of the unit’s mission or morale. On the reverse side of that,
Soldiers are required to bring matters to the attention of the command that may have a
negative impact on the unit. Information about the use of the commander’s open door
policy was not available for the Kreutzer case study, but in the Hasan case study the open
door policy was used by several of Hasan’s classmates while he attended his fellowship.
The second option in this variable is to command refer a Soldier to behavioral
health. According to Army Command Policy, when a Soldier makes statements that
threaten the use of violence or intent to inflict grave harm on their fellow Soldiers
commanders are required to refer the Soldier to Behavioral Health Services for a
psychiatric evaluation. In the case of William Kreutzer, his commander did make the
command referral. However, the psychologist determined that Kreutzer was not a
legitimate threat. Nidal Hasan’s commanders never referred him to behavioral health.
The last two options under “other actions” available to commanders are to report
the potential insider threat to Army CI or to law enforcement. Commanders, or fellow
Soldiers for that matter, did not report neither Kreutzer nor Hasan to CI personnel or to
law enforcement. Other actions used by commanders in the two case studies are
presented in the table below:
70
Table 14. Other Actions Available to Commanders
Source: Created by author.
Chapter Summary
Overall, both Kreutzer and Hasan presented indicators of potential insider threats
that should have been acted upon by their commanders and fellow Soldiers. Both Soldiers
in these cases violated articles punishable under UCMJ. Commanders in both cases used
some of the administrative actions available to them to deal with these threats, but in
neither case did they use their command authority to initiate punitive actions in the form
of nonjudicial punishment. The table of overall results, shown below, illustrates that
while Hasan’s tendencies of insider threat were more prevalent than Kreutzer, both
Soldiers presented enough indicators for commanders to act on them.
Other actions available Kreutzer HasanUse of an open door policy * (+)Command referral to Behavioral Health (+) (-)Report to Army CI (-) (-)Report to law enforcement (-) (-)*Information not available in the research.
7. Other actions available to commanders
71
Table 15. Overall Case Study Comparison Results
Source: Created by author.
The primary research question is answered in two primary sources, TARP and
Army Command Policy. Soldiers are compelled to report indicators of insider threat
through regulatory guidance that is supposed to be enforced through the use of UCMJ.
However, the findings of this analysis indicate that although indicators were observed in
both case studies, Soldiers did not report to Army CI or law enforcement and
commanders did not take any punitive actions available to them.
TARP alone provided the necessary information to identify the threat indicators
with Nidal Hasan. However, due to the fact that Kreutzer did not have any foreign
connections or ties to terrorist organizations, his actions were technically not reportable
under TARP as it stands today. His threats were disturbing and they did lead to a
command referral to behavioral health, but he was subsequently cleared by a mental
health professional. Kretzer presented a clear insider threat in the basic sense but did so in
a manner that is not reportable to Army CI.
Variables Kreutzer Hasan1. TARP Indicators of potential international terrorist-associated insider threats
(-) (+)
2. TARP Indicators of extremist activity that may pose a threat to the Department of Defense or disrupt US military operations
(-) (+)
3. Participation in extremist organizations and activities as defined by Army Command Policy
(+) (+)
4. Possible UCMJ violations for participation in extremist organizations or activities
(+) (+)
5. Administrative actions available to commanders used (+) (+)6. Punitive actions available to commanders used (-) (-)7. Other actions available to commanders used (+) (+)
Overall Results
72
CHAPTER 5
CONCLUSIONS AND RECOMMENDATIONS
Chapter Introduction
The primary research question of this thesis was: How does the Army compel
Soldiers to report suspicious activity associated with insider threats? The initial
hypothesis was: more training can be successful to reduce attacks. This training should
focus on two areas. First, soldiers and commanders need training to recognize when
potential insider threats are marginalized within their organizations, and how they can
bring these soldiers back into the fold. If soldiers are accepted for who they are and
brought into the cohesiveness of a team, they will be less likely to feel the need to
commit an act of violence against their peers. Second, training can help compel soldiers
to report suspicious behavior to their command or proper authorities. In order to answer
this question, two case studies were examined:
1. The Fort Bragg shooting of 27 October 1995 (Kreutzer).
2. The Fort Hood shooting of 5 November 2009 (Hasan).
Each case study used a qualitative analysis of seven variables: TARP indicators of
terrorist-associated insider threats, TARP indicators of extremist activities, participation
in extremist activities as identified in Army Command Policy, violations of the UCMJ,
administrative actions available to commanders, punitive actions available to
commanders, and other actions available to commanders (see table 16).
73
Conclusions
Prior to beginning this research project, the initial hypothesis, that more insider
threat training would increase reporting and therefore reduce attacks, was based on
observations that the Army only requires insider threat training once annually. It was
assumed that the current method of training generally consists of a unit receiving their
annual TARP brief in an auditorium-like setting, in conjunction with a plethora of other
AR 350-1 mandatory training. This environment is not conducive to Soldiers retaining
the information, which lends itself to TARP becoming an afterthought in the minds of
Soldiers. In addition, it was assumed that commanders, especially at the company level,
do not have a thorough understanding of the options available to them when they come
across a Soldier within their formations that display indicators of potential insider threats.
While these assumptions remain true, through the analysis of the two case studies, a more
complicated picture emerges.
As identified in the Fort Hood case study, MAJ Nidal Hasan presented several of
the indicators of insider threat that are outlined in TARP. While current TARP does
provide a comprehensive list of the indicators of violent attacks by insider threats, it lacks
the identification of potential lone wolf attacks with no ties to a foreign actor or ideology.
The nature of TARP indicators all have ties to a foreign nexus, which falls under the
purview of Army CI. However, as with the case of William Kreutzer, the indicators he
presented do not exactly line up with those outlined in TARP. Therefore, had the Soldiers
in Kreutzer’s unit reported his actions to Army CI, any initial inquiry into his case would
not have resulted into a full investigation because of a lack of a foreign nexus. Even
74
though Kreutzer clearly presented himself as a threat, CI officials would have been
powerless to act.
Although TARP does not specifically address insider threats such as Kreutzer,
another Army regulation does address these types of threats. Army Command Policy
identifies Soldiers such as Kreutzer as potential threats through participation in extremist
organizations or activities. This is specifically addressed as the use of force or violence or
unlawful means to deprive individuals of their rights under the United States Constitution
or the laws of the United States, or any State. If strictly interpreted, this could apply only
to those who actually carry out the use of force or violence, not those who only carry out
threats. However, Army Command Policy addresses this by stating how commanders are
responsible for maintaining good order and discipline within the unit. Any threats of
force or violence could be seen as detrimental to maintaining good order and discipline,
and therefore provide a means for the commander to act on those threats.
Another finding the research provided was that Soldiers who fail to report
potential insider threats are subject to punitive actions under the UCMJ. Although this is
explicitly stated in Army doctrine, there were no UCMJ actions reported for Soldiers who
failed to report in either case study. This brings up a potential dilemma for commanders.
Even though punitive actions are available to commanders for Soldiers who fail to report,
should they even use this option to compel Soldiers to report? How will punishing
additional Soldiers affect the moral of a unit that already potentially fell victim to a direct
action attack? Is the legal evidence present to follow through with such actions? The
conclusion is that punitive actions may not be the best approach to compelling Soldiers to
report potential insider threats.
75
Other options available include reinforcement of the commander’s open door
policy. If a commander sets the climate of transparency and fairness in the organization,
Soldiers may be more willing to use the open door policy to bring issues to the command.
Once an insider threat issue is brought to the command’s attention, they are required to
act on this information to maintain the good order and discipline in the unit. They can
bring the Soldier in to talk to them and potentially find out why they feel the way they do.
If actual threats are made, the commander can command refer the Soldier to behavioral
health for a mental health evaluation. Another option is to administratively separate the
Soldier for unsatisfactory performance or misconduct.
If the commander determines the Soldier’s statements or threats are correctable,
he/she may opt for nonjudicial punishment of the Soldier to put them on notice. However,
separation from the Army is always an option if the commander does not feel as if the
Soldier’s actions will be resolved through punitive actions. For repeated or more serious
offenses, the commander may recommend a trial by courts-martial. In any case, there are
several options the commander could use to address threats made by a potential insider
threat. The case studies found however that very few of the available options are used.
The final conclusion of this study found that current training requirements for
both Soldiers across the Army and commanders are not sufficient to properly address all
forms of direct action insider threats. TARP specifically has two shortfalls: First, that due
to the counterintelligence-leaning viewpoints on insider threats, it does not address those
Soldiers who have no connections to a foreign nexus, but are rather simply
disenfranchised with their unit and the Army and do not have a sufficient coping
mechanism; and second, that annual training conducted in a large auditorium setting is
76
not necessarily the best way to familiarize and reinforce identifying behavioral indicators
of insider threats. In addition commanders, particularly at the company level, are not
properly trained on all of the options available to them to address issues with good order
and discipline in their units. While Army Command Policy does lay these options out,
there is no formalized training on the matter in Army pre-command courses at the
company level.
Recommendations
In order for the Army to better compel Soldiers to report, the author’s
recommendations focus on addressing ways to improve the education of Soldiers and
commanders on insider threats through training. This thesis proposes two areas of
training that could be implemented across the Army. First, the annual TARP requirement
is not sufficient. To address this, it is recommended the Army add quarterly TARP
training in the form of scenario-based training as part of the Ready and Resilient
Campaign (R2C). Similarly to the implementation of SHARP training, scenario-based
training conducted at the unit level would supplement the annual requirement that a CI
special agent provides during their required unit briefs. This training would help Soldiers
identify the behavioral indicators of not only insider threats with a foreign nexus, but also
those indicators of Soldiers such as Kreutzer who threaten the use of force or violence
against fellow service members. In addition, this training would discuss the importance of
bringing disenfranchised Soldiers back into the fold and ways to accomplish this.
Training focused on all-inclusive unit cohesion would help Soldiers who feel neglected or
abandoned by their unit a sense of purpose and welcomed inclusiveness. As part of R2C,
unit commanders could enlist the help of behavioral health experts to aid in the training.
77
The second area of training would be to add a combined TARP/Army Command
Policy block of instruction to the Company Commanders and First Sergeant’s Course
conducted at the installation level. This training should focus on how to identify potential
insider threats within their organizations, as well as educate leaders on the options that
are available to them as outlined in TARP and Army Command Policy. These options
should cover the wide array of administrative and punitive actions as outlined in this
paper, as well as how to seek advice from behavioral health, legal, and other resources
the Army can provide.
Areas for Further Study
One potential area for future study on this topic is to research ways to improve
information sharing across different organizations within the Department of the Army. As
it currently stands, Army INSCOM, CID, and other law enforcement agencies all have
similar goals of preventing violent direct action attacks carried out by service members.
The Department of the Navy has the Naval Criminal Investigative Service (NCIS) and
the Air Force has the Office of Special Investigations (OSI). Yet the Army is the only
major service without a centralized intelligence, counterintelligence, and law
enforcement agency. Further research into this topic could potentially lead to Doctrine,
Organization, Training, Materiel, Leadership, Personnel, Facilities, and Policy
(DOTMLPF-P) changes in the Army to streamline information flow and investigations
into potential insider threats.
This study also assumed that while not all insider direct action attacks were the
result of Islamic Extremist views, these types of views are the driving force behind the
vast majority of insider threats, particularly after September 11, 2001. The wars in Iraq
78
and Afghanistan are sources of internal strife for some Muslim service members, which
when combined with perceived prejudices or unfair treatment can lead to self-
radicalization and eventually an attack. Further study into this trend could yield some
useful insights into how to counter the radicalization of Muslim Soldiers, which was not
specifically addressed in this study.
Summary
Current Army doctrine and regulations provide the means to properly identify and
counter direct action attacks carried out by insider threats. However, the training given to
Soldiers and commanders to educate them on these regulations is not sufficient to compel
them to report in all cases. The Fort Bragg shooting of 1995 and the Fort Hood shooting
of 2009 both highlight these training deficiencies. Allowing commanders at the unit level
to incorporate TARP training into their own training plans in the form of small group
scenario-based training will help reinforce not only the importance of TARP, but will
help them build unit cohesion and bring disenfranchised Soldiers back into the fold. In
addition, training commanders on the full range of options available to them during pre-
command courses will enable them to make informed decisions when they have to deal
with a potential insider threat within their organization.
79
GLOSSARY
Extremist Activity. An activity that involves the use of unlawful violence or the threat of unlawful violence directed against the Army, DOD, or the United States based on political, ideological, or religious tenets, principles, or beliefs.
Insider Threat. US service members or DOD employees who plan or carry out direct action attacks on fellow Soldiers and DOD employees with the intent to inflict loss of life through violent means.
Targeted Violence. Pre-meditated attacks against specific individuals, populations, or facilities with perpetrators engaged in behaviors that precede and are related to their attacks.
Terrorism. The calculated use of violence or threat of violence to inculcate fear, intended to coerce or to intimidate governments or societies in the pursuit of goals that are generally political, religious, or ideological.
Threat. According to AR 381-12, the activities of foreign intelligence services, foreign adversaries, international terrorist organizations, or extremists that may pose a danger to the Army, DOD, or the United States; any person with access to Soldiers, DOD installations, and facilities who may be positioned to compromise the ability of a unit to accomplish its mission where there is evidence to indicate that he may be acting on behalf of or in support of foreign Intelligence, foreign adversaries, international terrorists, or extremist causes.
80
BIBLIOGRAPHY
Baxter, Pamela, and Susan Jack. “Qualitative Case Study Methodology: Study Design and Implementation for Novice Researchers.” The Qualitative Report 13, no. 4 (December 2008): 544-559. Accessed 19 April 2017. http://www.nova.edu/ssss/ QR/QR13-4/baxter.pdf.
Bjelopera, Jerome P. American Jihadist Terrorism: Combating a Complex Threat, Washington, DC: Government Printing Office, November 2011.
Creswell, John W. Qualitative Inquiry and Research Design: Choosing Among Five Approaches. 2nd ed. Thousand Oaks, CA: Sage Publications, 2007.
Defense Science Board. Task Force Report: Predicting Violent Behavior. Washington, DC: Office of the Under Secretary of Defense for Acquisition, Technology and Logistics, 2012.
Denoeux, Guilain, and Lynn Carter. Guide to the Drivers of Violent Extremism. Washington, DC: US Agency for International Development, 2009.
Department of the Army. Army Regulation (AR) 27-10, Military Justice. Washington, DC: Government Printing Office, 2011.
———. Army Regulation (AR) 381-12, Threat Awareness and Reporting Program. Washington, DC: Government Printing Office, 2016.
———. Army Regulation (AR) 600-8-2, Suspension of Favorable Personnel Actions. Washington, DC: Government Printing Office, 2016.
———. Army Regulation (AR) 600-20, Army Command Policy. Washington, DC: Government Printing Office, 2014.
Department of Defense. Department of Defense Instruction (DoDI )1325.06, Handling Dissident and Protest Activities Among Members of the Armed Forces. Washington, DC: Government Printing Office, 2012.
———. Department of Defense Instruction (DODI) 6490.1, Mental Health Evaluations of Members of the Armed Forces. Washington, DC: Government Printing Office, 2003.
Gilsinan, Kathy, Kristina Popova, Jeffrey Stern, and Mira Wijayanti. Homegrown Violent Extremism and Military Targets. Washington, DC: Defense Intelligence Agency, 2012.
Joint Chiefs of Staff. Joint Publication (JP) 3-07.2, Antiterrorism. Washington, DC: Government Printing Office, 2010.
81
Herbig, Katherine L. Changes in Espionage by Americans: 1947-2007. Monterrey, CA: Defense Personnel Security Research Center, 2008.
Holthouse, David. “Several High Profile Racist Extremists Serve in the U.S. Military.” Intelligence Report (Summer 2006). Accessed 23 November 2016. http://www.splcenter.org/get-informed/intelligence-report/browse-all-issues/2006/summer/a-few-bad-men.
King, Peter T. Homegrown Terrorism: The Threat to Military Communities Inside the United States. Washington, DC: U.S. House of Representatives, 2011.
Lieberman, Joseph I., and Susan M. Collins. A Ticking Time Bomb: Counterterrorism Lessons from the U.S. Government’s Failure to Prevent the Fort Hood Attack. Washington, DC: U.S. Senate Committee on Homeland Security and Governmental Affairs, 2011. Accessed 21 November 2016, https://www.hsgac. senate.gov/imo/media/doc/Fort_Hood/FortHoodReport.pdf.
Obama, Barack H. Empowering Local Partners to Prevent Violent Extremism in the United States. Washington, DC: The White House, 2011.
Panetta, Leon E. Strategy for Homeland Defense and Defense Support of Civil Authorities. Washington, DC: Department of Defense, February 2013.
Silber, Michael D., and Arvin Bhatt. Radicalization in the West: The Homegrown Threat, Police Department, City of New York. Accessed 29 December 2016. www.sethgodin.typepad.com/seths_blog/files/NYPD_Report-Radicalization_in_ the_west.pdf.
Victoroff, Jeff. “The Mind of the Terrorist: A review and Critique of Psychological Approaches.” The Journal of Conflict Resolution 49, no. 1 (2005): 11-31, 33-36.
Wasserman, Robert. Guidance for Building Communities of Trust. Washington, DC: Department of Justice, 2010.
top related